From e854d6064afd6c9754232ce72deaf4b1d64d2dee Mon Sep 17 00:00:00 2001 From: ivan Date: Wed, 12 Aug 2026 23:21:23 +0500 Subject: [PATCH] ++ --- apps/attachments/wb/backend.yaml | 154 +++++++ apps/attachments/wb/kustomization.yaml | 7 +- apps/attachments/wb/patch.yaml | 40 -- apps/bim/wb/backend.yaml | 222 +++++++++ apps/bim/wb/kustomization.yaml | 2 +- apps/checklists/wb/backend.yaml | 145 ++++++ apps/checklists/wb/kustomization.yaml | 2 +- apps/contracts/wb/backend.yaml | 99 ++++ apps/contracts/wb/kustomization.yaml | 2 +- apps/django/wb/auth-flow-frontend.yaml | 97 ++++ apps/django/wb/backend.yaml | 375 +++++++++++++-- apps/django/wb/celery.yaml | 428 +++++++++++++++++ apps/django/wb/django-configmap.yaml | 287 ++++++++++++ apps/django/wb/export-project.yaml | 105 +++++ apps/django/wb/frontend.yaml | 118 +++++ apps/django/wb/gatekeeper.yaml | 120 +++++ apps/django/wb/kafka-cert-configmap.yaml | 38 ++ apps/django/wb/kustomization.yaml | 33 +- apps/django/wb/measurement.yaml | 112 +++++ apps/django/wb/nginx-configmap.yaml | 98 ++-- apps/django/wb/redis.yaml | 88 ++++ apps/django/wb/s3-proxy.yaml | 123 ++++- apps/django/wb/srx-admin.yaml | 95 ++++ apps/django/wb/uwsgi-configmap.yaml | 31 ++ apps/django/wb/zitadel-configmap.yaml | 8 +- apps/documentations/wb/api.yaml | 287 +++++++++--- apps/documentations/wb/filestream.yaml | 292 ++++++++++++ .../wb/frontend-public-link.yaml | 113 +++++ apps/documentations/wb/frontend-static.yaml | 88 ++++ apps/documentations/wb/kustomization.yaml | 19 +- apps/documentations/wb/pdf-markings-amqp.yaml | 193 ++++++++ apps/documentations/wb/pdf-markings.yaml | 231 ++++++++++ apps/documentations/wb/pdm-api.yaml | 342 ++++++++++++++ apps/documentations/wb/pdm.yaml | 176 ------- apps/documentations/wb/redis.yaml | 88 ++++ .../documentations/wb/stamp-verification.yaml | 90 ++++ apps/drawings/wb/backend.yaml | 120 +++++ apps/drawings/wb/kustomization.yaml | 2 +- apps/eav/wb/backend.yaml | 191 ++++++++ apps/eav/wb/django-configmap.yaml | 147 ++++++ apps/eav/wb/kafka-cert-configmap.yaml | 38 ++ apps/eav/wb/kustomization.yaml | 4 +- apps/faas/wb/backend.yaml | 91 +++- apps/faas/wb/kustomization.yaml | 7 +- apps/flows/wb/authentication-configmap.yaml | 93 ++++ apps/flows/wb/backend.yaml | 206 ++++++++- apps/flows/wb/celery.yaml | 308 +++++++++++++ apps/flows/wb/frontend.yaml | 95 ++++ apps/flows/wb/kustomization.yaml | 10 +- apps/inspections/wb/backend.yaml | 142 +++++- apps/inspections/wb/kustomization.yaml | 7 +- apps/issues/wb/app-configmap.yaml | 55 +++ apps/issues/wb/backend.yaml | 85 ---- apps/issues/wb/celery.yaml | 284 +++++++++++- apps/issues/wb/issues.yaml | 270 +++++++++++ apps/issues/wb/kafka-cert-configmap.yaml | 38 ++ apps/issues/wb/kustomization.yaml | 19 +- apps/issues/wb/production-configmap.yaml | 143 ++++++ apps/issues/wb/redis.yaml | 88 ++++ apps/issues/wb/remarks-static.yaml | 90 ++++ apps/issues/wb/static.yaml | 88 ++++ apps/issues/wb/uwsgi-configmap.yaml | 23 + apps/message-hub/wb/kafka-cert-configmap.yaml | 38 ++ apps/message-hub/wb/kustomization.yaml | 3 +- apps/message-hub/wb/message-hub.yaml | 209 +++++++++ apps/pm/wb/backend-configmap.yaml | 30 ++ apps/pm/wb/backend.yaml | 153 ++++++ apps/pm/wb/celery.yaml | 146 ++++++ apps/pm/wb/kafka-cert-configmap.yaml | 38 ++ apps/pm/wb/kustomization.yaml | 6 +- apps/pm/wb/redis.yaml | 88 ++++ apps/processing/wb/engine-low.yaml | 434 ++++++++++++++++++ apps/processing/wb/engine.yaml | 427 +++++++++++++++++ apps/processing/wb/frontend.yaml | 88 ++++ apps/processing/wb/kustomization.yaml | 13 +- apps/processing/wb/rbac.yaml | 19 - apps/processing/wb/workflows-api.yaml | 142 ++++++ apps/projects/wb/frontend.yaml | 95 ++++ apps/projects/wb/kustomization.yaml | 2 +- apps/reviews/wb/frontend.yaml | 95 ++++ apps/reviews/wb/kustomization.yaml | 2 +- apps/rfi/wb/backend.yaml | 203 ++++++++ apps/rfi/wb/celery.yaml | 193 ++++++++ apps/rfi/wb/frontend.yaml | 95 ++++ apps/rfi/wb/kustomization.yaml | 4 +- apps/subscriptions/wb/backend.yaml | 203 ++++++++ apps/subscriptions/wb/django-configmap.yaml | 102 ++++ apps/subscriptions/wb/kustomization.yaml | 9 +- apps/subscriptions/wb/patch.yaml | 22 - apps/subscriptions/wb/uwsgi-configmap.yaml | 22 + apps/system-log/wb/api.yaml | 196 ++++++++ apps/system-log/wb/kustomization.yaml | 3 +- apps/system-log/wb/worker.yaml | 147 ++++++ apps/transmittal/wb/backend.yaml | 182 +++++++- apps/transmittal/wb/frontend.yaml | 95 ++++ apps/transmittal/wb/kustomization.yaml | 13 +- apps/transmittal/wb/worker.yaml | 174 ++++++- apps/workspaces/wb/api.yaml | 169 +++++++ apps/workspaces/wb/frontend.yaml | 88 ++++ apps/workspaces/wb/kustomization.yaml | 3 +- clusters/wb/kustomization.yaml | 1 + 101 files changed, 10617 insertions(+), 727 deletions(-) create mode 100644 apps/attachments/wb/backend.yaml delete mode 100644 apps/attachments/wb/patch.yaml create mode 100644 apps/bim/wb/backend.yaml create mode 100644 apps/checklists/wb/backend.yaml create mode 100644 apps/contracts/wb/backend.yaml create mode 100644 apps/django/wb/auth-flow-frontend.yaml create mode 100644 apps/django/wb/celery.yaml create mode 100644 apps/django/wb/django-configmap.yaml create mode 100644 apps/django/wb/export-project.yaml create mode 100644 apps/django/wb/frontend.yaml create mode 100644 apps/django/wb/gatekeeper.yaml create mode 100644 apps/django/wb/kafka-cert-configmap.yaml create mode 100644 apps/django/wb/measurement.yaml create mode 100644 apps/django/wb/redis.yaml create mode 100644 apps/django/wb/srx-admin.yaml create mode 100644 apps/django/wb/uwsgi-configmap.yaml create mode 100644 apps/documentations/wb/filestream.yaml create mode 100644 apps/documentations/wb/frontend-public-link.yaml create mode 100644 apps/documentations/wb/frontend-static.yaml create mode 100644 apps/documentations/wb/pdf-markings-amqp.yaml create mode 100644 apps/documentations/wb/pdf-markings.yaml create mode 100644 apps/documentations/wb/pdm-api.yaml delete mode 100644 apps/documentations/wb/pdm.yaml create mode 100644 apps/documentations/wb/redis.yaml create mode 100644 apps/documentations/wb/stamp-verification.yaml create mode 100644 apps/drawings/wb/backend.yaml create mode 100644 apps/eav/wb/backend.yaml create mode 100644 apps/eav/wb/django-configmap.yaml create mode 100644 apps/eav/wb/kafka-cert-configmap.yaml create mode 100644 apps/flows/wb/authentication-configmap.yaml create mode 100644 apps/flows/wb/celery.yaml create mode 100644 apps/flows/wb/frontend.yaml create mode 100644 apps/issues/wb/app-configmap.yaml delete mode 100644 apps/issues/wb/backend.yaml create mode 100644 apps/issues/wb/issues.yaml create mode 100644 apps/issues/wb/kafka-cert-configmap.yaml create mode 100644 apps/issues/wb/production-configmap.yaml create mode 100644 apps/issues/wb/redis.yaml create mode 100644 apps/issues/wb/remarks-static.yaml create mode 100644 apps/issues/wb/static.yaml create mode 100644 apps/issues/wb/uwsgi-configmap.yaml create mode 100644 apps/message-hub/wb/kafka-cert-configmap.yaml create mode 100644 apps/message-hub/wb/message-hub.yaml create mode 100644 apps/pm/wb/backend-configmap.yaml create mode 100644 apps/pm/wb/backend.yaml create mode 100644 apps/pm/wb/celery.yaml create mode 100644 apps/pm/wb/kafka-cert-configmap.yaml create mode 100644 apps/pm/wb/redis.yaml create mode 100644 apps/processing/wb/engine-low.yaml create mode 100644 apps/processing/wb/engine.yaml create mode 100644 apps/processing/wb/frontend.yaml delete mode 100644 apps/processing/wb/rbac.yaml create mode 100644 apps/processing/wb/workflows-api.yaml create mode 100644 apps/projects/wb/frontend.yaml create mode 100644 apps/reviews/wb/frontend.yaml create mode 100644 apps/rfi/wb/backend.yaml create mode 100644 apps/rfi/wb/celery.yaml create mode 100644 apps/rfi/wb/frontend.yaml create mode 100644 apps/subscriptions/wb/backend.yaml create mode 100644 apps/subscriptions/wb/django-configmap.yaml delete mode 100644 apps/subscriptions/wb/patch.yaml create mode 100644 apps/subscriptions/wb/uwsgi-configmap.yaml create mode 100644 apps/system-log/wb/api.yaml create mode 100644 apps/system-log/wb/worker.yaml create mode 100644 apps/transmittal/wb/frontend.yaml create mode 100644 apps/workspaces/wb/api.yaml create mode 100644 apps/workspaces/wb/frontend.yaml diff --git a/apps/attachments/wb/backend.yaml b/apps/attachments/wb/backend.yaml new file mode 100644 index 0000000..e614eae --- /dev/null +++ b/apps/attachments/wb/backend.yaml @@ -0,0 +1,154 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: attachments + namespace: attachments + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + attachments: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/att9:dev + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: attachments + + replicaCount: + _default: 1 + + port: + _default: 8000 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: attachments-service + + type: + _default: ClusterIP + + port: + _default: 8000 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + volumes: + _default: + - name: yc-s3 + mountPath: + _default: /etc/sarex/yc-s3-storage + readOnly: + _default: true + secret: + secretName: + _default: yc-s3 + + envs: + - name: POSTGRES_POOL_SIZE + value: + _default: "10" + + - name: API_ADDRESS + value: + _default: "0.0.0.0:8000" + + - name: YANDEX_S3_ACCOUNT_PATH + value: + _default: "/etc/sarex/yc-s3-storage/yc-s3-service-account.json" + + - name: BUCKET_NAME + value: + _default: "attachments-storage" + + - name: DATABASE_SSL_MODE + value: + _default: "disable" + + - name: YANDEX_S3_VERIFY + value: + _default: "false" + + - name: YANDEX_S3_USE_SSL + value: + _default: "false" + + secretEnvs: + - name: DATABASE_HOST + secretName: + _default: "postgres-secret" + secretKey: "host" + + - name: DATABASE_PORT + secretName: + _default: "postgres-secret" + secretKey: "port" + + - name: DATABASE_NAME + secretName: + _default: "postgres-secret" + secretKey: "database" + + - name: DATABASE_USER + secretName: + _default: "postgres-secret" + secretKey: "username" + + - name: DATABASE_PASSWORD + secretName: + _default: "postgres-secret" + secretKey: "password" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/attachments/wb/kustomization.yaml b/apps/attachments/wb/kustomization.yaml index 6fae072..8cd3447 100644 --- a/apps/attachments/wb/kustomization.yaml +++ b/apps/attachments/wb/kustomization.yaml @@ -3,9 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: attachments resources: - - ../base -patches: - - path: patch.yaml - target: - kind: HelmRelease - name: attachments + - backend.yaml diff --git a/apps/attachments/wb/patch.yaml b/apps/attachments/wb/patch.yaml deleted file mode 100644 index 0fcba12..0000000 --- a/apps/attachments/wb/patch.yaml +++ /dev/null @@ -1,40 +0,0 @@ ---- -# Эндпоинт MinIO для контура wb. -# -# В base зашит YANDEX_S3_ENDPOINT_URL=minio.minio:9000 — заглушка, недоступная -# в кластере wb. Реальный адрес/бакет — из terraform 1.yaml (infrastructure.minio.apps.attachments -# для wb): client.endpoint=http://10.49.10.90:9000, buckets[0].name=sarex-media-storage. -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: attachments - namespace: attachments -spec: - values: - services: - attachments: - podAnnotations: - _default: - vault.hashicorp.com/auth-path: auth/kubernetes - vault.hashicorp.com/role: attachments - vault.hashicorp.com/agent-inject-secret-attachments-db: secrets/data/apps/attachments/postgres - vault.hashicorp.com/agent-inject-template-attachments-db: |- - {{- with secret "secrets/data/apps/attachments/postgres" -}} - DATABASE_HOST={{ index .Data.data "host" }} - DATABASE_PORT={{ index .Data.data "port" }} - DATABASE_NAME={{ index .Data.data "database" }} - DATABASE_USER={{ index .Data.data "username" }} - DATABASE_PASSWORD={{ index .Data.data "password" }} - DATABASE_SSL_MODE=disable - {{- end -}} - vault.hashicorp.com/agent-inject-secret-attachments-s3: secrets/data/minio/apps/attachments - vault.hashicorp.com/agent-inject-template-attachments-s3: |- - {{- with secret "secrets/data/minio/apps/attachments" -}} - YANDEX_S3_ENDPOINT_URL=10.49.10.90:9000 - YANDEX_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} - YANDEX_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} - YANDEX_S3_USE_SSL=false - YANDEX_S3_REGION=ru-central - YANDEX_S3_VERIFY=false - BUCKET_NAME=sarex-media-storage - {{- end -}} diff --git a/apps/bim/wb/backend.yaml b/apps/bim/wb/backend.yaml new file mode 100644 index 0000000..1f34413 --- /dev/null +++ b/apps/bim/wb/backend.yaml @@ -0,0 +1,222 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: bim + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + backend: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/bim-backend-v2:donstroi1 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: backend + + replicaCount: + _default: 1 + + port: + _default: 8000 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: backend-service + + type: + _default: ClusterIP + + port: + _default: 8000 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + envs: + - name: LAST_MASTER_BIM + value: + _default: "100000" + + - name: LAST_MASTER_BIM_V3 + value: + _default: "100000" + + - name: LAST_SLAVE_1_BIM + value: + _default: "1000000" + + - name: POSTGRES_ADDRESS + value: + _default: "sarex-vpsql-01.xc.wb.ru" + + - name: POSTGRES_PORT + value: + _default: "6432" + + - name: POSTGRES_DB + value: + _default: "bim_db" + + - name: DB_CERT_PATH_2 + value: + _default: "/root/yandex_pg.pem" + + - name: POSTGRES_ADDRESS_2 + value: + _default: "sarex-vpsql-01.xc.wb.ru" + + - name: POSTGRES_PORT_2 + value: + _default: "6432" + + - name: POSTGRES_DB_2 + value: + _default: "bim_db" + + - name: DB_CERT_PATH_3 + value: + _default: "/root/yandex_pg.pem" + + - name: POSTGRES_ADDRESS_3 + value: + _default: "sarex-vpsql-01.xc.wb.ru" + + - name: POSTGRES_PORT_3 + value: + _default: "6432" + + - name: POSTGRES_DB_3 + value: + _default: "bim_db" + + - name: DB_CERT_PATH_4 + value: + _default: "/root/yandex_pg.pem" + + - name: POSTGRES_ADDRESS_4 + value: + _default: "sarex-vpsql-01.xc.wb.ru" + + - name: POSTGRES_PORT_4 + value: + _default: "6432" + + - name: POSTGRES_DB_4 + value: + _default: "bim_db" + + - name: POSTGRES_POOL_SIZE + value: + _default: "30" + + - name: API_ADDRESS + value: + _default: "0.0.0.0:8000" + + - name: DJANGO_HOST + value: + _default: "http://backend.django.svc.cluster.local:8000" + + - name: ENABLE_SQL_QUERY + value: + _default: "0" + + - name: ENABLE_SSL + value: + _default: "0" + + secretEnvs: + - name: POSTGRES_USER + secretName: + _default: "postgres-secret" + secretKey: "username" + + - name: POSTGRES_PASSWORD + secretName: + _default: "postgres-secret" + secretKey: "password" + + - name: POSTGRES_USER_2 + secretName: + _default: "postgres-secret" + secretKey: "username" + + - name: POSTGRES_PASSWORD_2 + secretName: + _default: "postgres-secret" + secretKey: "password" + + - name: POSTGRES_USER_3 + secretName: + _default: "postgres-secret" + secretKey: "username" + + - name: POSTGRES_PASSWORD_3 + secretName: + _default: "postgres-secret" + secretKey: "password" + + - name: POSTGRES_USER_4 + secretName: + _default: "postgres-secret" + secretKey: "username" + + - name: POSTGRES_PASSWORD_4 + secretName: + _default: "postgres-secret" + secretKey: "password" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/bim/wb/kustomization.yaml b/apps/bim/wb/kustomization.yaml index 3342d19..5524cd9 100644 --- a/apps/bim/wb/kustomization.yaml +++ b/apps/bim/wb/kustomization.yaml @@ -3,4 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: bim resources: - - ../base + - backend.yaml diff --git a/apps/checklists/wb/backend.yaml b/apps/checklists/wb/backend.yaml new file mode 100644 index 0000000..112e31b --- /dev/null +++ b/apps/checklists/wb/backend.yaml @@ -0,0 +1,145 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: checklists-backend + namespace: checklists + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + checklists-backend: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/checklists-backend:production_68f242cd + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: checklists-backend + + replicaCount: + _default: 1 + + port: + _default: 80 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: checklists-backend-service + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + envs: + - name: HTTP_APP_HOST + value: + _default: "0.0.0.0" + + - name: HTTP_APP_PORT + value: + _default: "8000" + + - name: HTTP_APP_ROOT_PATH + value: + _default: "/checklists" + + - name: HTTP_APP_WORKERS + value: + _default: "8" + + - name: HTTP_APP_ADMIN_ENABLE + value: + _default: "true" + + - name: DATABASE_HOST + value: + _default: "sarex-vpsql-01.xc.wb.ru" + + - name: DATABASE_PORT + value: + _default: "5432" + + - name: DATABASE_NAME + value: + _default: "checklists_db" + + - name: JWT_AUTH_ENABLE + value: + _default: "true" + + - name: DEBUG + value: + _default: "false" + + secretEnvs: + - name: DATABASE_USER + secretName: + _default: "postgres-secret" + secretKey: "user" + + - name: DATABASE_PASSWORD + secretName: + _default: "postgres-secret" + secretKey: "password" + + - name: JWT_AUTH_PUBLIC_KEY + secretName: + _default: "jwt-secret" + secretKey: "public-key" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/checklists/wb/kustomization.yaml b/apps/checklists/wb/kustomization.yaml index 14638e2..b1927b6 100644 --- a/apps/checklists/wb/kustomization.yaml +++ b/apps/checklists/wb/kustomization.yaml @@ -3,4 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: checklists resources: - - ../base + - backend.yaml diff --git a/apps/contracts/wb/backend.yaml b/apps/contracts/wb/backend.yaml new file mode 100644 index 0000000..0ef438c --- /dev/null +++ b/apps/contracts/wb/backend.yaml @@ -0,0 +1,99 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: contracts + namespace: contracts + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + contracts: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/contracts:prod_d3bbd9fc + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: contracts + + replicaCount: + _default: 1 + + port: + _default: 8080 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: contracts-service + + type: + _default: ClusterIP + + port: + _default: 8080 + + targetPort: + _default: 8080 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + secretEnvs: + - name: DB_URL + secretName: + _default: "ya-pg-secret" + secretKey: "db_url" + + - name: PUBLIC_KEY + secretName: + _default: "public-key" + secretKey: "key" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/contracts/wb/kustomization.yaml b/apps/contracts/wb/kustomization.yaml index ce4670f..0125b87 100644 --- a/apps/contracts/wb/kustomization.yaml +++ b/apps/contracts/wb/kustomization.yaml @@ -3,4 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: contracts resources: - - ../base + - backend.yaml diff --git a/apps/django/wb/auth-flow-frontend.yaml b/apps/django/wb/auth-flow-frontend.yaml new file mode 100644 index 0000000..a56c452 --- /dev/null +++ b/apps/django/wb/auth-flow-frontend.yaml @@ -0,0 +1,97 @@ +--- +# auth-flow-frontend — компонент приложения auth-flow (apps/auth-flow), +# в wb развёрнут в ns django, а не в своём собственном неймспейсе. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: auth-flow-frontend + namespace: django + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + auth-flow-frontend: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/auth-flow-frontend:contour_fe9ea2a3 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: auth-flow-frontend + + replicaCount: + _default: 1 + + port: + _default: 80 + + resources: + requests: + cpu: + _default: 100m + memory: + _default: 128Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: auth-flow-frontend-service + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 80 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/django/wb/backend.yaml b/apps/django/wb/backend.yaml index 09e5b7b..27de798 100644 --- a/apps/django/wb/backend.yaml +++ b/apps/django/wb/backend.yaml @@ -1,167 +1,444 @@ --- -# Патч backend для контура wb. -# -# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch), -# поэтому здесь продублирован весь набор из apps/django/base/backend.yaml. -# podAnnotations — map, мержится по ключам, поэтому переопределён только -# agent-inject-template-django-s3; остальные vault-аннотации берутся из base. -# -# В base SERVER_API_HOST/SERVER_HOST/ZITADEL_HOST/S3 смотрят на тестовый -# контур contour.infra.sarex.tech — для wb это srx.wb.ru / zitadel-srx.wb.ru -# (см. apps/documentations/base — там те же домены уже дефолт) и свой MinIO -# (terraform 1.yaml, infrastructure.minio.apps.django для wb: client.endpoint=http://10.49.10.90:9000). -# WORKFLOWS_HOST в base смотрит на ns processing — в wb processing развёрнут -# в ns workflow (apps/processing/wb), поэтому тоже поправлен. apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: name: backend namespace: django + spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: backend: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/backend:preprod_78a9bdc0 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: backend + + replicaCount: + _default: 1 + + port: + _default: 8000 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: backend-svc + + type: + _default: ClusterIP + + port: + _default: 8000 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + volumes: + _default: + - name: tmp-volume + mountPath: + _default: /tmp + emptyDir: {} + + - name: uwsgi-configmap + mountPath: + _default: /opt/sarex/uwsgi.ini + subPath: + _default: uwsgi.ini + readOnly: + _default: true + configMap: + name: + _default: uwsgi-configmap + items: + - key: uwsgi.ini + path: + _default: uwsgi.ini + + - name: django-configmap + mountPath: + _default: /opt/sarex/config/settings/production.py + subPath: + _default: production.py + readOnly: + _default: true + configMap: + name: + _default: django-configmap + items: + - key: production.py + path: + _default: production.py + + - name: kafka-cert-volume + mountPath: + _default: /usr/local/share/ca-certificates + readOnly: + _default: true + configMap: + name: + _default: kafka-cert + envs: + - name: GK_ENCRYPTION_KEY + value: + _default: "zfDjuszywHSbAhY8KJQbESbpUYN74XTs" + - name: ALLOWED_HOSTS value: _default: "*" + - name: SERVER_USE_CHANGELOG value: _default: "0" + - name: SERVER_ZITADEL_ENABLED value: _default: "True" + - name: DJANGO_SETTINGS_MODULE value: - _default: config.settings.production + _default: "config.settings.production" + - name: CELERY_REDIS_HOST value: - _default: redis + _default: "redis-service" + - name: CELERY_REDIS_PORT value: _default: "6379" + - name: DJANGO_REDIS_HOST value: - _default: redis - - name: SERVER_EXTERNAL_FIND_BY_USERNAME_ENABLED - value: - _default: "True" - - name: SERVER_EXTERNAL_FIND_BY_EMAIL_ENABLED - value: - _default: "True" + _default: "redis-service" + - name: DJANGO_REDIS_PORT value: _default: "6379" + - name: BIMV2_INTERNAL_HOST value: - _default: http://bim-backend-v2-service.bim-api + _default: "http://bim-backend-v2-service.bim-api" + - name: BIMV2_TIMEOUT value: _default: "60" + - name: JWT_KID value: _default: "1" + - name: PDM_SYNC value: _default: "1" + - name: KC_SYNC_ENABLE value: _default: "0" + - name: MEASUREMENTS_HOST value: - _default: http://measurements-service.measurements.svc.cluster.local:8000/api + _default: "http://measurements-service.measurements.svc.cluster.local:8000/api" + - name: MEASUREMENTS_USE_MEASUREMENTS value: _default: "1" + + - name: SERVER_EXTERNAL_FIND_BY_USERNAME_ENABLED + value: + _default: "True" + + - name: SERVER_EXTERNAL_FIND_BY_EMAIL_ENABLED + value: + _default: "True" + - name: SERVER_API_HOST value: - _default: https://srx.wb.ru + _default: "https://srx.wb.ru" + - name: SERVER_HOST value: - _default: https://srx.wb.ru + _default: "https://srx.wb.ru" + - name: WORKFLOWS_HOST value: - _default: http://backend-svc.workflow.svc.cluster.local:80 + _default: "https://srx.wb.ru" + - name: WORKFLOWS_BASE_HOST value: - _default: http://backend-svc.django.svc.cluster.local:80 - - name: WORKFLOWS_PREFIX - value: - _default: /internal/v1 + _default: "https://srx.wb.ru" + - name: WORKFLOWS_USE value: _default: "1" + - name: SERVER_S3_STREAM_IMPORT value: _default: "1" + - name: SERVER_SAVE_DIFF_DEM value: _default: "1" + - name: SERVER_USE_CLICKHOUSE value: _default: "0" + - name: SERVER_USE_CREATE_COMPARED_GEOTIFF_TASK value: _default: "0" + - name: SERVER_USE_DJANGO_STORAGE value: _default: "1" + - name: SERVER_USE_METASHAPE value: _default: "0" + - name: SERVER_CHANGELOG_MODE_SYSTEM_LOG value: _default: "1" + - name: SERVER_CHANGELOG_MODE value: _default: "0" + - name: SERVER_DJANGO_URLS value: _default: "1" + - name: CHECK_IMPORT_HASH value: _default: "1" + - name: EAV_ENABLE value: _default: "1" + - name: SERVER_CHECK_IMPORT_HASH value: _default: "1" + - name: SERVER_CHUNKED_PATH value: - _default: /tmp/chunked_uploads/%Y/%m/%d + _default: "/tmp/chunked_uploads/%Y/%m/%d" + - name: SERVER_HIDE_USER_SCROLL_PERMISSIONS value: _default: "0" + - name: SERVER_USE_WRORKFLOW_STATUS value: _default: "1" + - name: ZITADEL_HOST value: - _default: https://zitadel-srx.wb.ru + _default: "https://zitadel-srx.wb.ru" + - name: SERVER_KAFKA_ENABLED value: - _default: "False" + _default: "True" + - name: KAFKA_TOPICS value: _default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}' + + - name: KAFKA_BOOTSTRAP_SERVERS + value: + _default: '["wb-prod-kafka-bootstrap.kafka.svc.cluster.local:9093"]' + + - name: KAFKA_SECURITY_PROTOCOL + value: + _default: "SSL" + + - name: KAFKA_SASL_MECHANISM + value: + _default: "SCRAM-SHA-512" + - name: KAFKA_SSL_CAFILE value: - _default: /usr/local/share/ca-certificates/kafka.crt + _default: "/usr/local/share/ca-certificates/kafka.crt" + + - name: S3_HOST + value: + _default: "http://10.49.10.90:9000" + - name: KC_USE_REDIRECT_LOGOUT value: _default: "False" - podAnnotations: - _default: - vault.hashicorp.com/agent-inject-template-django-s3: |- - {{- with secret "secrets/data/minio/apps/django" }} - AWS_S3_ENDPOINT_URL=http://10.49.10.90:9000 - S3_HOST=http://10.49.10.90:9000 - {{- $buckets := index .Data.data "buckets" }} - S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }} - S3_LOGIN={{ index .Data.data "access_key" }} - S3_PASSWORD={{ index .Data.data "secret_key" }} - AWS_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} - AWS_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} - AWS_STORAGE_BUCKET_NAME={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }} - {{- end }} + + secretEnvs: + - name: ZITADEL_ACCESS_TOKEN + secretName: + _default: "zitadel-secret" + secretKey: "access_token" + + - name: KAFKA_SASL_PLAIN_USERNAME + secretName: + _default: "kafka-secret" + secretKey: "username" + + - name: KAFKA_SASL_PLAIN_PASSWORD + secretName: + _default: "kafka-secret" + secretKey: "password" + + - name: KC_CLIENT_ID + secretName: + _default: "gatekeeper-secret" + secretKey: "client_id" + + - name: KC_CLIENT_SECRET + secretName: + _default: "gatekeeper-secret" + secretKey: "client_secret" + + - name: AWS_S3_ENDPOINT_URL + secretName: + _default: "s3-secret" + secretKey: "endpoint" + + - name: CELERY_RABBITMQ_HOST + secretName: + _default: "rabbitmq-secret" + secretKey: "host" + + - name: CELERY_RABBITMQ_USER + secretName: + _default: "rabbitmq-secret" + secretKey: "username" + + - name: CELERY_RABBITMQ_PASSWORD + secretName: + _default: "rabbitmq-secret" + secretKey: "password" + + - name: CELERY_RABBITMQ_VHOST + secretName: + _default: "rabbitmq-secret" + secretKey: "vhost" + + - name: DJANGO_POSTGRES_HOST + secretName: + _default: "postgres-secret" + secretKey: "host" + + - name: DJANGO_POSTGRES_PORTS + secretName: + _default: "postgres-secret" + secretKey: "port" + + - name: DJANGO_POSTGRES_USER + secretName: + _default: "postgres-secret" + secretKey: "username" + + - name: DJANGO_POSTGRES_PASSWORD + secretName: + _default: "postgres-secret" + secretKey: "password" + + - name: DJANGO_POSTGRES_DATABASE + secretName: + _default: "postgres-secret" + secretKey: "database" + + - name: DJANGO_RABBIT_HOSTNAME + secretName: + _default: "rabbitmq-secret" + secretKey: "host" + + - name: DJANGO_RABBIT_USER + secretName: + _default: "rabbitmq-secret" + secretKey: "username" + + - name: DJANGO_RABBIT_PASS + secretName: + _default: "rabbitmq-secret" + secretKey: "password" + + - name: DJANGO_RABBIT_VHOST + secretName: + _default: "rabbitmq-secret" + secretKey: "vhost" + + - name: JWT_PRIVATE_KEY + secretName: + _default: "backend-secret" + secretKey: "ssh_private.key" + + - name: JWT_PUBLIC_KEY + secretName: + _default: "backend-secret" + secretKey: "ssh_public.key" + + - name: S3_BUCKET + secretName: + _default: "sarex-media-storage-secret" + secretKey: "bucket" + + - name: S3_LOGIN + secretName: + _default: "sarex-media-storage-secret" + secretKey: "login" + + - name: S3_PASSWORD + secretName: + _default: "sarex-media-storage-secret" + secretKey: "password" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/django/wb/celery.yaml b/apps/django/wb/celery.yaml new file mode 100644 index 0000000..ac8839d --- /dev/null +++ b/apps/django/wb/celery.yaml @@ -0,0 +1,428 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: celery + namespace: django + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + celery: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/backend:production_a96dead0 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: celery + + replicaCount: + _default: 1 + + port: + _default: 8000 + + command: + _default: ["celery", "-A", "config", "worker", "-B", "-l", "info", "-E", "-Q", "default", "-n", "default_worker.%h", "--concurrency=2"] + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + volumes: + _default: + - name: tmp-volume + mountPath: + _default: /tmp + emptyDir: {} + + - name: uwsgi-configmap + mountPath: + _default: /opt/sarex/uwsgi.ini + subPath: + _default: uwsgi.ini + readOnly: + _default: true + configMap: + name: + _default: uwsgi-configmap + items: + - key: uwsgi.ini + path: + _default: uwsgi.ini + + - name: django-configmap + mountPath: + _default: /opt/sarex/config/settings/production.py + subPath: + _default: production.py + readOnly: + _default: true + configMap: + name: + _default: django-configmap + items: + - key: production.py + path: + _default: production.py + + - name: kafka-cert-volume + mountPath: + _default: /usr/local/share/ca-certificates + readOnly: + _default: true + configMap: + name: + _default: kafka-cert + + envs: + - name: GK_ENCRYPTION_KEY + value: + _default: "zfDjuszywHSbAhY8KJQbESbpUYN74XTs" + + - name: ALLOWED_HOSTS + value: + _default: "*" + + - name: SERVER_USE_CHANGELOG + value: + _default: "0" + + - name: SERVER_ZITADEL_ENABLED + value: + _default: "False" + + - name: DJANGO_SETTINGS_MODULE + value: + _default: "config.settings.production" + + - name: CELERY_REDIS_HOST + value: + _default: "redis-service" + + - name: CELERY_REDIS_PORT + value: + _default: "6379" + + - name: DJANGO_REDIS_HOST + value: + _default: "redis-service" + + - name: CACHE_HOST + value: + _default: "redis.pm.svc.cluster.local" + + - name: DJANGO_REDIS_PORT + value: + _default: "6379" + + - name: BIMV2_INTERNAL_HOST + value: + _default: "http://bim-backend-v2-service.bim-api" + + - name: BIMV2_TIMEOUT + value: + _default: "60" + + - name: JWT_KID + value: + _default: "1" + + - name: PDM_SYNC + value: + _default: "1" + + - name: KC_SYNC_ENABLE + value: + _default: "0" + + - name: MEASUREMENTS_HOST + value: + _default: "http://measurements-service.measurements.svc.cluster.local:8000/api" + + - name: MEASUREMENTS_USE_MEASUREMENTS + value: + _default: "1" + + - name: SERVER_API_HOST + value: + _default: "https://srx.wb.ru" + + - name: SERVER_HOST + value: + _default: "https://srx.wb.ru" + + - name: WORKFLOWS_HOST + value: + _default: "https://srx.wb.ru" + + - name: WORKFLOWS_BASE_HOST + value: + _default: "https://srx.wb.ru" + + - name: WORKFLOWS_USE + value: + _default: "1" + + - name: SERVER_S3_STREAM_IMPORT + value: + _default: "1" + + - name: SERVER_SAVE_DIFF_DEM + value: + _default: "1" + + - name: SERVER_USE_CLICKHOUSE + value: + _default: "0" + + - name: SERVER_USE_CREATE_COMPARED_GEOTIFF_TASK + value: + _default: "0" + + - name: SERVER_USE_DJANGO_STORAGE + value: + _default: "1" + + - name: SERVER_USE_METASHAPE + value: + _default: "0" + + - name: SERVER_CHANGELOG_MODE_SYSTEM_LOG + value: + _default: "1" + + - name: ZITADEL_HOST + value: + _default: "https://zitadel-srx.wb.ru" + + - name: SERVER_KAFKA_ENABLED + value: + _default: "True" + + - name: KAFKA_TOPICS + value: + _default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}' + + - name: KAFKA_BOOTSTRAP_SERVERS + value: + _default: '["wb-prod-kafka-bootstrap.kafka.svc.cluster.local:9093"]' + + - name: KAFKA_SECURITY_PROTOCOL + value: + _default: "SSL" + + - name: KAFKA_SASL_MECHANISM + value: + _default: "SCRAM-SHA-512" + + - name: KAFKA_SSL_CAFILE + value: + _default: "/usr/local/share/ca-certificates/kafka.crt" + + - name: SERVER_CHANGELOG_MODE + value: + _default: "0" + + - name: SERVER_DJANGO_URLS + value: + _default: "1" + + - name: CHECK_IMPORT_HASH + value: + _default: "1" + + - name: EAV_ENABLE + value: + _default: "1" + + - name: SERVER_CHECK_IMPORT_HASH + value: + _default: "1" + + - name: SERVER_CHUNKED_PATH + value: + _default: "/tmp/chunked_uploads/%Y/%m/%d" + + - name: SERVER_HIDE_USER_SCROLL_PERMISSIONS + value: + _default: "0" + + - name: SERVER_USE_WRORKFLOW_STATUS + value: + _default: "1" + + - name: S3_HOST + value: + _default: "http://10.49.10.90:9000" + + - name: KC_USE_REDIRECT_LOGOUT + value: + _default: "False" + + secretEnvs: + - name: ZITADEL_ACCESS_TOKEN + secretName: + _default: "zitadel-secret" + secretKey: "access_token" + + - name: KAFKA_SASL_PLAIN_USERNAME + secretName: + _default: "kafka-secret" + secretKey: "username" + + - name: KAFKA_SASL_PLAIN_PASSWORD + secretName: + _default: "kafka-secret" + secretKey: "password" + + - name: KC_CLIENT_ID + secretName: + _default: "gatekeeper-secret" + secretKey: "client_id" + + - name: KC_CLIENT_SECRET + secretName: + _default: "gatekeeper-secret" + secretKey: "client_secret" + + - name: AWS_S3_ENDPOINT_URL + secretName: + _default: "s3-secret" + secretKey: "endpoint" + + - name: CELERY_RABBITMQ_HOST + secretName: + _default: "rabbitmq-secret" + secretKey: "host" + + - name: CELERY_RABBITMQ_USER + secretName: + _default: "rabbitmq-secret" + secretKey: "username" + + - name: CELERY_RABBITMQ_PASSWORD + secretName: + _default: "rabbitmq-secret" + secretKey: "password" + + - name: CELERY_RABBITMQ_VHOST + secretName: + _default: "rabbitmq-secret" + secretKey: "vhost" + + - name: DJANGO_POSTGRES_HOST + secretName: + _default: "postgres-secret" + secretKey: "host" + + - name: DJANGO_POSTGRES_PORTS + secretName: + _default: "postgres-secret" + secretKey: "port" + + - name: DJANGO_POSTGRES_USER + secretName: + _default: "postgres-secret" + secretKey: "username" + + - name: DJANGO_POSTGRES_PASSWORD + secretName: + _default: "postgres-secret" + secretKey: "password" + + - name: DJANGO_POSTGRES_DATABASE + secretName: + _default: "postgres-secret" + secretKey: "database" + + - name: DJANGO_RABBIT_HOSTNAME + secretName: + _default: "rabbitmq-secret" + secretKey: "host" + + - name: DJANGO_RABBIT_USER + secretName: + _default: "rabbitmq-secret" + secretKey: "username" + + - name: DJANGO_RABBIT_PASS + secretName: + _default: "rabbitmq-secret" + secretKey: "password" + + - name: DJANGO_RABBIT_VHOST + secretName: + _default: "rabbitmq-secret" + secretKey: "vhost" + + - name: JWT_PRIVATE_KEY + secretName: + _default: "backend-secret" + secretKey: "ssh_private.key" + + - name: JWT_PUBLIC_KEY + secretName: + _default: "backend-secret" + secretKey: "ssh_public.key" + + - name: S3_BUCKET + secretName: + _default: "sarex-media-storage-secret" + secretKey: "bucket" + + - name: S3_LOGIN + secretName: + _default: "sarex-media-storage-secret" + secretKey: "login" + + - name: S3_PASSWORD + secretName: + _default: "sarex-media-storage-secret" + secretKey: "password" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/django/wb/django-configmap.yaml b/apps/django/wb/django-configmap.yaml new file mode 100644 index 0000000..938a7c9 --- /dev/null +++ b/apps/django/wb/django-configmap.yaml @@ -0,0 +1,287 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: django-configmap + namespace: django +data: + production.py: | + + import os + from .base import * + from logging.handlers import SysLogHandler + from datetime import timedelta + + ALLOWED_HOSTS = ["*"] + FILE_UPLOAD_PERMISSIONS = 0o644 + DEBUG = False + CSRF_COOKIE_SECURE = True + CSRF_TRUSTED_ORIGINS = ["https://lk.srx.wb.ru:30443", "https://lk.srx.wb.ru"] + SESSION_COOKIE_SECURE = True + SECURE_SSL_REDIRECT = False + + SECRET_KEY = 't2=9+($2f%7ptsdy4!rby$)mcfl1l%o2e@vs^d(g&(wwi&%k1v' + + CORS_ORIGIN_ALLOW_ALL = True + SERVERSETTINGS.cache_enabled = True + INSTALLED_APPS = list(INSTALLED_APPS) + ['corsheaders'] + + CORS_ALLOW_METHODS = ( + 'DELETE', + 'GET', + 'OPTIONS', + 'PATCH', + 'POST', + 'PUT', + ) + BASIC_USER_ID = 2 + + CORS_ALLOW_HEADERS = ( + 'accept', + 'accept-encoding', + 'authorization', + 'content-type', + 'user-agent', + 'x-csrftoken', + 'x-requested-with', + 'x-token', + 'Bearer', + ) + + HOST = "https://wb.sarex.io" + + POSTGRES_DATABASE = os.environ.get('DJANGO_POSTGRES_DATABASE') + POSTGRES_USER = os.environ.get('DJANGO_POSTGRES_USER') + POSTGRES_PASSWORD = os.environ.get('DJANGO_POSTGRES_PASSWORD') + POSTGRES_HOST = os.environ.get('DJANGO_POSTGRES_HOST') + POSTGRES_PORTS = os.environ.get('DJANGO_POSTGRES_PORTS', "5432") + + DATABASES = { + 'default': { + 'ENGINE': 'django_prometheus.db.backends.postgresql', + 'NAME': POSTGRES_DATABASE, + 'USER': POSTGRES_USER, + 'PASSWORD': POSTGRES_PASSWORD, + 'HOST': POSTGRES_HOST, + 'PORT': POSTGRES_PORTS, + } + } + + LOGGING = { + 'version': 1, + 'disable_existing_loggers': False, + 'filters': { + 'require_debug_false': { + '()': 'django.utils.log.RequireDebugFalse', + } + }, + 'formatters': { + 'verbose': { + 'format': '[contactor] %(levelname)s %(asctime)s %(message)s', + }, + }, + 'handlers': { + 'console': { + 'level': 'DEBUG', + 'class': 'logging.StreamHandler', + }, + 'sentry': { + 'level': 'ERROR', + 'filters': ['require_debug_false'], + 'class': 'logging.StreamHandler', + }, + }, + 'loggers': { + '': { + 'handlers': ['console', 'sentry'], + 'level': 'INFO', + 'propagate': False, + }, + } + } + + COMPARATOR_JWT = os.environ.get("COMPARATOR_JWT", "default_jwt") + COMPARATOR_URL = os.environ.get("COMPARATOR_URL", "https://wb.sarex.io/comparator") + COMPARATOR_SECTION = os.environ.get("COMPARATOR_SECTION", "sarex-production-storage") + + SIMPLE_JWT = { + 'ACCESS_TOKEN_LIFETIME': timedelta(hours=1), + 'REFRESH_TOKEN_LIFETIME': timedelta(days=1), + 'ROTATE_REFRESH_TOKENS': False, + 'BLACKLIST_AFTER_ROTATION': True, + 'UPDATE_LAST_LOGIN': False, + 'ALGORITHM': 'RS512', + 'SIGNING_KEY': os.environ.get("JWT_PRIVATE_KEY").replace("\\n", "\n"), + 'VERIFYING_KEY': os.environ.get("JWT_PUBLIC_KEY").replace("\\n", "\n"), + 'AUDIENCE': None, + 'ISSUER': os.environ.get('SIMPLE_JWT_ISSUER', 'default_issuer'), + 'AUTH_HEADER_TYPES': ('Bearer',), + 'AUTH_HEADER_NAME': 'HTTP_AUTHORIZATION', + 'USER_ID_FIELD': 'id', + 'USER_ID_CLAIM': 'user_id', + 'AUTH_TOKEN_CLASSES': ('rest_framework_simplejwt.tokens.AccessToken',), + 'TOKEN_TYPE_CLAIM': 'token_type', + 'JTI_CLAIM': 'jti', + 'SLIDING_TOKEN_REFRESH_EXP_CLAIM': 'refresh_exp', + 'SLIDING_TOKEN_LIFETIME': timedelta(minutes=5), + 'SLIDING_TOKEN_REFRESH_LIFETIME': timedelta(days=1), + } + + os.environ["DJANGO_ALLOW_ASYNC_UNSAFE"] = "true" + DEFAULT_FILE_STORAGE = 'sarex.core.storages.CustomS3Boto3Storage' + DATA_UPLOAD_MAX_MEMORY_SIZE = 268435456 + + if not os.environ.get('ISOLATED', False): + import sentry_sdk + from sentry_sdk.integrations.django import DjangoIntegration + + sentry_sdk.init( + dsn="https://3df2f4b8d3d14595a06c92e9d7c562cb@sentry.io/1501541", + integrations=[DjangoIntegration()], + environment=os.environ.get('SENTRY_ENVIRONMENT', 'production'), + send_default_pii=True, + ) + + COMPARISON_API_URL = f"{os.environ.get('WORKFLOWSSETTINGS_HOST')}/comparisons" + DOCUMENTATION_API_URL = f"{os.environ.get('WORKFLOWSSETTINGS_HOST')}/documentations" + PDM_FILES_API_URL = f"{os.environ.get('WORKFLOWSSETTINGS_HOST')}/files" + + WORKFLOWS_TASKS = { + "update_orthomosaic_data": { + "image": f"{os.environ.get('WORKFLOWSSETTINGS_REGISTRY')}/update-orthomosaic-data:dev", + "service_requests": ["django-auth"], + "backoff_limit": 3, + }, + } + + REST_FRAMEWORK = { 'DEFAULT_PAGINATION_CLASS': ( + 'rest_framework.pagination.LimitOffsetPagination' ), + 'DEFAULT_SCHEMA_CLASS': 'rest_framework.schemas.coreapi.AutoSchema', + 'PAGE_SIZE': 1000, 'DEFAULT_FILTER_BACKENDS': [ + 'django_filters.rest_framework.DjangoFilterBackend' ], + 'DEFAULT_AUTHENTICATION_CLASSES': [ + 'sarex.authentication.backends.ZitadelJWTAuthentication', + 'rest_framework.authentication.RemoteUserAuthentication', + 'rest_framework_simplejwt.authentication.JWTAuthentication', + 'rest_framework.authentication.BasicAuthentication', + 'rest_framework.authentication.SessionAuthentication', + 'sarex.authentication.backends.JWTAuthentication' ], + 'DEFAULT_PERMISSION_CLASSES': [ + 'rest_framework.permissions.IsAuthenticated', ] } + + AUTHENTICATION_BACKENDS = [ + 'sarex.authentication.backends.CustomRemoteUserBackend', + 'django.contrib.auth.backends.ModelBackend', + 'guardian.backends.ObjectPermissionBackend', + ] + + MIDDLEWARE = [ + 'django_prometheus.middleware.PrometheusBeforeMiddleware', + 'django.middleware.security.SecurityMiddleware', + 'django.contrib.sessions.middleware.SessionMiddleware', + 'django.middleware.common.CommonMiddleware', + 'django.middleware.csrf.CsrfViewMiddleware', + #'django_keycloak.middlewares.AuthorizationHeaderMiddleware', + #'django_keycloak.middlewares.KeycloakSessionMiddleware', + 'django.contrib.auth.middleware.AuthenticationMiddleware', + #'django.contrib.auth.middleware.RemoteUserMiddleware', + 'django.contrib.messages.middleware.MessageMiddleware', + 'django.middleware.clickjacking.XFrameOptionsMiddleware', + 'django_user_agents.middleware.UserAgentMiddleware', + 'simple_history.middleware.HistoryRequestMiddleware', + 'django_prometheus.middleware.PrometheusAfterMiddleware', ] + + + class KeyCloakSettings(BaseSettings): + client_id: str = "client_id" + client_secret: str = "client_secret" + discovery_url: str = "https://login.wb.sarex.io/realms/sarex/.well-known/openid-configuration" + staff: Optional[str] = "Sarex staff" + superuser: Optional[str] = "Sarex superusers" + sync_with_django: bool = True + sync_admin: bool = False + group_prefix: str = 'Sarex-Role' + company_prefix: str = 'Sarex-Company' + department_prefix: str = 'Sarex-Department' + position_prefix: str = 'Sarex-Position' + separator: str = '__' + sync_user_groups: bool = False + sync_user_positions: bool = False + sync_user_departments: bool = False + sync_user_companies: bool = False + use_redirect_logout: bool = False + logout_redirect_uri: str = "/" + default_group_name: Optional[str] = 'Тест' + default_company_name: Optional[str] = 'Брусника' + trusted_uri: List[str] = ['/api/core/orthophotos/', '/api/token', '/api/token/me'] + trusted_uri: List[str] = [] + + class Config: + env_prefix = "KC_" + + + KEYCLOAKSETTINGS = KeyCloakSettings() + + REMOTE_USER_DEFAULT_COMPANY_ID = 1 + SAREX_MODULES = [ + { + "name": "Замечания", + "uri": "/remarks" + }, + { + "name": "Управление проектами", + "uri": "/management/projects", + }, + { + "name": "Замечания V2", + "uri": "/issues" + }, + { + "name": "Документация", + "uri": "/documentations" + }, + { + "name": "Согласование документов", + "uri": "/reviews" + }, + { + "name": "Рабочие процессы", + "uri": "/processes" + }, + { + "name": "Запросы", + "uri": "/rfi" + }, + + { + "name": "Аналитика", + "uri": "/analytics" + }, + # { + # "name": "Обзор", + # "uri": "/projects" + # }, + { + "name": "Передача документации", + "uri": "/transmittal" + }, + ] + AUTH_SETTINGS = { + "refresh_token": False, + "refresh_token_uri": "/api/token/me", + "refresh_oauth_token": True, + "refresh_oauth_token_uri": "/oauth/token", + "refresh_time": 240, + } + + + DEBUG=False + #WEB_APP_AUTH_MODE='jwt-session-based' + + + SAREX_MODULES_SETTINGS = { + "aero": { + "enable_new_media": True + }, + "sso_logout_redirect": True + } diff --git a/apps/django/wb/export-project.yaml b/apps/django/wb/export-project.yaml new file mode 100644 index 0000000..49cb1a6 --- /dev/null +++ b/apps/django/wb/export-project.yaml @@ -0,0 +1,105 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: export-project + namespace: django + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + export-project: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/export-project:prod_ef8aa756 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: export-project + + replicaCount: + _default: 1 + + port: + _default: 8000 + + resources: + limits: + cpu: + _default: "2" + memory: + _default: 8Gi + requests: + cpu: + _default: "1" + memory: + _default: 512Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: export-project-service + + type: + _default: ClusterIP + + port: + _default: 8000 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + envs: + - name: TIMEOUT + value: + _default: "180" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/django/wb/frontend.yaml b/apps/django/wb/frontend.yaml new file mode 100644 index 0000000..16ee9f0 --- /dev/null +++ b/apps/django/wb/frontend.yaml @@ -0,0 +1,118 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: frontend + namespace: django + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + frontend: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-frontend-dev:contour_5.22.3 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: frontend + + replicaCount: + _default: 1 + + port: + _default: 80 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: frontend-service + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 80 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + volumes: + _default: + - name: nginx-configmap + mountPath: + _default: /etc/nginx/nginx.conf + subPath: + _default: nginx.conf + configMap: + name: + _default: nginx-configmap + items: + - key: nginx.conf + path: + _default: nginx.conf + + - name: zitadel-configmap + mountPath: + _default: /opt/react_client/static/config.json + subPath: + _default: config.json + readOnly: + _default: true + configMap: + name: + _default: zitadel-configmap + items: + - key: config.json + path: + _default: config.json + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/django/wb/gatekeeper.yaml b/apps/django/wb/gatekeeper.yaml new file mode 100644 index 0000000..3f27faf --- /dev/null +++ b/apps/django/wb/gatekeeper.yaml @@ -0,0 +1,120 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: gatekeeper + namespace: django + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + gatekeeper: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/gatekeeper:2.12.1 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: gatekeeper + + replicaCount: + _default: 1 + + port: + _default: 8080 + + args: + _default: + - "--discovery-url=https://keycloak.wildberries.ru/realms/infrastructure/.well-known/openid-configuration" + - "--listen=0.0.0.0:8080" + - "--enable-logging=true" + - "--upstream-url=http://frontend-service.django.svc.cluster.local:80/" + - "--enable-refresh-tokens=true" + - "--enable-session-cookies=true" + - "--verbose" + - "--resources=uri=/*" + - "--encryption-key=zfDjuszywHSbAhY8KJQbESbpUYN74XTs" + - "--secure-cookie=false" + - "--cors-origins=*" + - "--skip-openid-provider-tls-verify=true" + - "--enable-default-deny=false" + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: gatekeeper-service + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 8080 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + envs: + - name: PROXY_REDIRECTION_URL + value: + _default: "https://lk.srx.wb.ru" + + secretEnvs: + - name: PROXY_CLIENT_ID + secretName: + _default: "gatekeeper-secret" + secretKey: "client_id" + + - name: PROXY_CLIENT_SECRET + secretName: + _default: "gatekeeper-secret" + secretKey: "client_secret" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/django/wb/kafka-cert-configmap.yaml b/apps/django/wb/kafka-cert-configmap.yaml new file mode 100644 index 0000000..4432f96 --- /dev/null +++ b/apps/django/wb/kafka-cert-configmap.yaml @@ -0,0 +1,38 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: kafka-cert + namespace: django +data: + kafka.crt: | + -----BEGIN CERTIFICATE----- + MIIFLTCCAxWgAwIBAgIUYDZPxGRsr7IiqHEmfd07QTQlOKYwDQYJKoZIhvcNAQEN + BQAwLTETMBEGA1UECgwKaW8uc3RyaW16aTEWMBQGA1UEAwwNY2x1c3Rlci1jYSB2 + MDAeFw0yNTEyMTYxNDM0NTVaFw0yNjEyMTYxNDM0NTVaMC0xEzARBgNVBAoMCmlv + LnN0cmltemkxFjAUBgNVBAMMDWNsdXN0ZXItY2EgdjAwggIiMA0GCSqGSIb3DQEB + AQUAA4ICDwAwggIKAoICAQCfzDZhEzw2pbU5Xpu8OzD+3iQG+DVjU8PQWWQEF27h + yjohDkUr3zCZtW7xMKWKUNxBgrKsfe4TDOQN8cij3cS9sy0So+UhMeF7Bq9PU1Yd + bmTRq8q1PiuNUkiCGJ5wrb3+NZvVxZLJUIFgiealsRw80MgMWWSzy0I35T2Edn/a + DU4jhlgQxyzQ621+oGP0n28gCjmm6pCq2tkj/Z8WTdu1gOWyRdK02a2uE2Ts2nLa + Di32GaZrIbIuD/WUd6Ek66uCeJvh2CT7s+SqgtMbtT7gibUuPQ3hk1VGQsjy22l3 + hUNpLu86nrwbuf21mY55KnLOcaVq1ag1TpIIKfZAL/KWFCGZ6H6kwEIbCAL0Hei7 + cJ2Wm2/qlzKUeU869M7YybZAfXl/t6XT4QgFgje+42N980vy5A4GhWi1Z7lPqqOe + jPGBstkRZybKz1sTk87+oJx82iQU/ozVmzjSEK1SoYRNbvug8PNpxmPoPnJ2flgG + t2q2+2ZQP3f1aAHVcZ3U5+hWlRmKPXzjrJv7gnhuvqJl7OwB50y+yWiVfZ9xrYl2 + EpX+yHuFFK+9NnB5taUK8Fz+hQaLU8J4q7P0bRqkoI+LdcEErjuDT/eI2d5+Ql8K + /JkV823hX2WNB9bdaQ24BelVUbsxGpR7ms6KWrM11kHnbzUlEM+AxZES6F7Qbr55 + TwIDAQABo0UwQzAdBgNVHQ4EFgQUM7hshx7e9TFEN82Pf446aBrJUA4wEgYDVR0T + AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQENBQADggIB + AFNHFGPDxY966fz0dxDFFSfeo47y7XQZMK9xAwH73cQoSeqx+IMxzgM8nfJQ9XMN + PeLwVRZ7pvRee2ZhUPglBSTHnW2rvfmLBOO9xyKZxRsCkoFxuHH9xfM7bFWb96R6 + fGrOdEZDB3yj00T+tkubwqt+/dUhQUj8juwyPs55WMb/0BIbapaoQ6QOP13CaXDV + ZmAfsEEIBkNxfq7GTr/z0Rq0B4+9FxAf3Jrsmi/dYoFD/prHsvBDkYw1daoFyp5C + tbctvB9wtphnCCynekt8UBvpVKHUU/xaUa09TQTToXjBbV1SZeIOHNG0MNbWa4sz + AL/cpXdq1EAxiTeAVT9XhCwhe/xJvFZIWuFLmW3J+ZxrOUCKieCYpTqBY2tBkkDY + //egic787yTR6zxqQNSzvNU5LhzrN7lu+KHGM06T35+HvpzgPPiRCzsxO62p63op + mq04K31yYZgLiqeAj5W+rioRGJNn4TXJpH9KIrzmGM7lVWLYWMAKeZU4r1lDUdcu + 7jsBH8BRJWJeVK3xVw2HB3lk7Xn0WrR92adeYQ3f0vKbMIAVUnSJ3yCKJ4NMFSki + j78nx2mi/G0RhUPGZ9hhLXQKj9BtbpEnwpbGWtf0ShtVOxD/HKLCr7koBtW9TMPS + 9K0sJhE5VjsQLkDDu9p3GdRcuLNA/oa7xFvRFtqGFsLj + -----END CERTIFICATE----- diff --git a/apps/django/wb/kustomization.yaml b/apps/django/wb/kustomization.yaml index 84e0533..7d6a816 100644 --- a/apps/django/wb/kustomization.yaml +++ b/apps/django/wb/kustomization.yaml @@ -3,21 +3,18 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: django resources: - - ../base -patches: - - path: backend.yaml - target: - kind: HelmRelease - name: backend - - path: zitadel-configmap.yaml - target: - kind: ConfigMap - name: zitadel-configmap - - path: s3-proxy.yaml - target: - kind: HelmRelease - name: s3-proxy - - path: nginx-configmap.yaml - target: - kind: ConfigMap - name: nginx-configmap + - django-configmap.yaml + - uwsgi-configmap.yaml + - zitadel-configmap.yaml + - nginx-configmap.yaml + - kafka-cert-configmap.yaml + - backend.yaml + - celery.yaml + - export-project.yaml + - frontend.yaml + - gatekeeper.yaml + - measurement.yaml + - redis.yaml + - s3-proxy.yaml + - srx-admin.yaml + - auth-flow-frontend.yaml diff --git a/apps/django/wb/measurement.yaml b/apps/django/wb/measurement.yaml new file mode 100644 index 0000000..2a6e154 --- /dev/null +++ b/apps/django/wb/measurement.yaml @@ -0,0 +1,112 @@ +--- +# measurement — компонент приложения measurements (apps/measurements), +# в wb развёрнут в ns django, а не в своём собственном неймспейсе. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: measurement + namespace: django + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + measurement: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/measurements:prod_ece72657 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: measurement + + replicaCount: + _default: 1 + + port: + _default: 8000 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: measurement-service + + type: + _default: ClusterIP + + port: + _default: 8000 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + volumes: + _default: + - name: tmp-volume + mountPath: + _default: /tmp + emptyDir: {} + + envs: + - name: DJANGO_HOST + value: + _default: "https://lk.srx.wb.ru:30443" + + - name: S3_JSON_FILE + value: + _default: "/opt/cred_s3.json" + + secretEnvs: + - name: S3_JSON_SETTINGS + secretName: + _default: "s3-json-settings" + secretKey: "S3_JSON_SETTINGS" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/django/wb/nginx-configmap.yaml b/apps/django/wb/nginx-configmap.yaml index 9c179f2..669fb78 100644 --- a/apps/django/wb/nginx-configmap.yaml +++ b/apps/django/wb/nginx-configmap.yaml @@ -1,9 +1,4 @@ --- -# В base nginx проксирует /workflows/ на frontend-svc.processing — в wb -# processing развёрнут в ns workflow (apps/processing/wb), поэтому правим -# proxy_pass. ConfigMap.data — карта с единственным ключом nginx.conf, значит -# приходится продублировать содержимое целиком (map мержится по ключам, но -# ключ тут один и это цельная строка). apiVersion: v1 kind: ConfigMap metadata: @@ -68,83 +63,58 @@ data: if_modified_since off; expires off; } - location ~^/api/pm/ { #rewrite /api/(.+) /$1 break; - proxy_http_version 1.1; - proxy_set_header Connection ""; proxy_set_header Host $host; - proxy_pass http://backend-svc.pm.svc.cluster.local:8000; + proxy_pass http://backend-service.pm.svc.cluster.local:8000; + } + + location ~^/media/ { + rewrite ^/media/(.*)$ /$1 break; + proxy_set_header Host $host; + proxy_pass http://s3-proxy-service:80; } location ~^/api/v1/documents/ { - proxy_http_version 1.1; #rewrite /api/(.+) /$1 break; proxy_set_header Host $host; - proxy_pass http://backend-filestream-svc.documentations.svc.cluster.local:80; + proxy_pass http://documentations-filestream.documentations.svc.cluster.local:8080; } location ~^/(api|admin)/ { - proxy_http_version 1.1; - proxy_set_header Connection ""; proxy_set_header Host $host; - proxy_pass http://backend-svc.django.svc.cluster.local:80; + proxy_pass http://backend:8000; } + # location ~^/flows/static/ { + # rewrite /flows/static/(.+) /$1 break; + # proxy_pass http://frontend-service.flows:80; + # } - location = /static/pdf-runtime/assets/mupdf-wasm.wasm { - alias /opt/react_client/static/pdf-runtime/assets/mupdf-wasm.wasm; - add_header Content-Type application/wasm always; - add_header Cache-Control "public, max-age=31536000, immutable" always; - add_header Access-Control-Allow-Origin "*" always; - add_header Access-Control-Allow-Methods "GET, OPTIONS" always; - add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always; - } + # location = ~^/orchestrator/ { + # rewrite ^/orchestrator$ /api/ break; + # proxy_pass http://cde.orchestrator.svc.cluster.local:8080; + # } - location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.js { - alias /opt/react_client/static/viewer-pdf/mupdf-wasm.js; - add_header Content-Type application/javascript always; - add_header Cache-Control "public, max-age=31536000, immutable" always; - add_header Access-Control-Allow-Origin "*" always; - add_header Access-Control-Allow-Methods "GET, OPTIONS" always; - add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always; - } + # location = ~^/orchestrator/api/process { + # rewrite ^/orchestrator/api/process$ /api/process break; + # proxy_pass http://cde.orchestrator.svc.cluster.local:8080; + # } - location = /workspaces-v2/worker/mupdf.worker-3.3.9.js { - alias /opt/react_client/static/pdf-runtime/mupdf.worker-3.3.9.js; - add_header Content-Type application/javascript always; - add_header Cache-Control "public, max-age=31536000, immutable" always; - add_header Access-Control-Allow-Origin "*" always; - add_header Access-Control-Allow-Methods "GET, OPTIONS" always; - add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always; - } + # location ~ ^/orchestrator/api/process/(.*)$ { + # rewrite ^/orchestrator/api/process/(.*)$ /api/process/$1 break; + # proxy_pass http://cde.orchestrator.svc.cluster.local:8080; + # } - location = /workspaces-v2/worker/static/viewer-pdf/mupdf.js { - alias /opt/react_client/static/viewer-pdf/mupdf.js; - add_header Content-Type application/javascript always; - add_header Cache-Control "public, max-age=31536000, immutable" always; - add_header Access-Control-Allow-Origin "*" always; - add_header Access-Control-Allow-Methods "GET, OPTIONS" always; - add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always; - } + # location = ~^/orchestrator/api/sign { + # rewrite ^/orchestrator/api/sign$ /api/sign break; + # proxy_pass http://cde.orchestrator.svc.cluster.local:8080; + # } - location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.wasm { - add_header Content-Type application/wasm always; - alias /opt/react_client/static/viewer-pdf/mupdf-wasm.wasm; - } - location ~^/workspaces-v2/(.+).js { - proxy_http_version 1.1; - proxy_set_header Connection ""; + location ~^/workspaces-v2/(.+).js { rewrite /workspaces-v2/(.+) /$1 break; - proxy_pass http://frontend-svc.workspaces.svc.cluster.local:80; - } - - location ~^/workspaces-v2/(.+)\.wasm$ { - proxy_http_version 1.1; - proxy_set_header Connection ""; - rewrite ^/workspaces-v2/(.+) /$1 break; - proxy_pass http://frontend-svc.workspaces.svc.cluster.local:80; + proxy_pass http://workspaces-v2-frontend-static-service.workspaces.svc.cluster.local:8080; } location @index { @@ -155,10 +125,8 @@ data: } location ~^/workflows/(.+).js { - proxy_http_version 1.1; - proxy_set_header Connection ""; - rewrite /workflows/(.+) /$1 break; - proxy_pass http://frontend-svc.workflow.svc.cluster.local:80; + rewrite /workflows/(.+) /$1 break; + proxy_pass http://frontend-service.workflow.svc.cluster.local:8080; } location /service-worker.js { try_files /static/$uri @index; diff --git a/apps/django/wb/redis.yaml b/apps/django/wb/redis.yaml new file mode 100644 index 0000000..dfaf0ec --- /dev/null +++ b/apps/django/wb/redis.yaml @@ -0,0 +1,88 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: redis + namespace: django + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + redis: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/redis:latest + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: redis + + replicaCount: + _default: 1 + + port: + _default: 6379 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: redis-service + + type: + _default: ClusterIP + + port: + _default: 6379 + + targetPort: + _default: 6379 + + portName: + _default: tcp + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/django/wb/s3-proxy.yaml b/apps/django/wb/s3-proxy.yaml index acff88c..6d96ffe 100644 --- a/apps/django/wb/s3-proxy.yaml +++ b/apps/django/wb/s3-proxy.yaml @@ -1,26 +1,117 @@ --- -# Патч s3-proxy для контура wb. -# -# В base зашит AWS_API_ENDPOINT=https://minio.contour.infra.sarex.tech — -# недоступен в wb. Эндпоинт задан литералом, а не через .Data.data.client.endpoint, -# так же как в apps/django/wb/backend.yaml для того же секрета -# secrets/data/minio/apps/django — держим один способ на весь ns. apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: name: s3-proxy namespace: django + spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: s3-proxy: - podAnnotations: - _default: - vault.hashicorp.com/agent-inject-template-s3: | - {{- with secret "secrets/data/minio/apps/django" }} - AWS_API_ENDPOINT=http://10.49.10.90:9000 - {{- $buckets := index .Data.data "buckets" }} - AWS_S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }} - AWS_ACCESS_KEY_ID={{ index .Data.data "access_key" }} - AWS_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} - {{- end }} + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/s3-proxy:stable + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: s3-proxy + + replicaCount: + _default: 1 + + port: + _default: 80 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: s3-proxy-service + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 80 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + envs: + - name: AWS_API_ENDPOINT + value: + _default: "http://10.49.10.90:9000" + + - name: ACCESS_LOG + value: + _default: "true" + + - name: CORS_ALLOW_HEADERS + value: + _default: "Content-Type, Accept-Ranges, Content-Range, Content-Encoding" + + secretEnvs: + - name: AWS_ACCESS_KEY_ID + secretName: + _default: "sarex-media-storage-secret" + secretKey: "login" + + - name: AWS_SECRET_ACCESS_KEY + secretName: + _default: "sarex-media-storage-secret" + secretKey: "password" + + - name: AWS_S3_BUCKET + secretName: + _default: "sarex-media-storage-secret" + secretKey: "bucket" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/django/wb/srx-admin.yaml b/apps/django/wb/srx-admin.yaml new file mode 100644 index 0000000..ca01e20 --- /dev/null +++ b/apps/django/wb/srx-admin.yaml @@ -0,0 +1,95 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: srx-admin + namespace: django + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + srx-admin: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/srx-admin:prod_c73e9855 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: srx-admin + + replicaCount: + _default: 1 + + port: + _default: 80 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: srx-admin-svc + + type: + _default: ClusterIP + + port: + _default: 8080 + + targetPort: + _default: 80 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + volumes: + _default: + - name: tmp-volume + mountPath: + _default: /tmp + emptyDir: {} + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/django/wb/uwsgi-configmap.yaml b/apps/django/wb/uwsgi-configmap.yaml new file mode 100644 index 0000000..57072f0 --- /dev/null +++ b/apps/django/wb/uwsgi-configmap.yaml @@ -0,0 +1,31 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: uwsgi-configmap + namespace: django +data: + uwsgi.ini: | + [uwsgi] + module = config.wsgi:application + DJANGO_SETTINGS_MODULE = config.settings.production + http = 0.0.0.0:8000 + processes = 16 + master = true + vacuum = true + enable-threads = true + buffer-size = 65535 + stats = :3031 + stats-http = true + memory-report = true + lazy-apps = true + listen = 128 + disable-write-exception= 0 + harakiri = 300 + socket-timeout = 300 + chunked-input-timeout = 300 + http-timeout = 300 + worker-reload-mercy = 240 + mule-reload-mercy = 240 + static-map = /static=/opt/sarex/sarex/static/ + static-map = /media=/media/ diff --git a/apps/django/wb/zitadel-configmap.yaml b/apps/django/wb/zitadel-configmap.yaml index bf184ad..bda6e9c 100644 --- a/apps/django/wb/zitadel-configmap.yaml +++ b/apps/django/wb/zitadel-configmap.yaml @@ -1,19 +1,15 @@ --- -# Хост Zitadel для wb — zitadel-srx.wb.ru (подтверждено). -# client_id пока оставлен от base (тестовый контур) — это ID OAuth-клиента, -# зарегистрированного в конкретном Zitadel-инстансе, его нужно завести/уточнить -# отдельно для zitadel-srx.wb.ru перед реальным включением django на wb. apiVersion: v1 kind: ConfigMap metadata: name: zitadel-configmap namespace: django data: - config.json: | + config.json: |- { "auth_type": "zitadel", "zitadel": { - "client_id": "379557107642492501", + "client_id": "363741990556356237", "host": "https://zitadel-srx.wb.ru" } } diff --git a/apps/documentations/wb/api.yaml b/apps/documentations/wb/api.yaml index 5eb6500..c7c4238 100644 --- a/apps/documentations/wb/api.yaml +++ b/apps/documentations/wb/api.yaml @@ -1,170 +1,335 @@ --- -# Патч documentations-api для контура wb. -# -# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch), -# поэтому здесь продублирован весь набор из apps/documentations/base/api.yaml. -# -# В base WORKSPACE_V2_EXTERNAL_URL и FILE_STREAM_HOST почему-то остались на -# тестовом контуре contour.infra.sarex.tech, хотя соседний -# apps/documentations/base/filestream.yaml для тех же полей уже использует -# srx.wb.ru — берём то же значение (рассинхрон между api.yaml и -# filestream.yaml в base, не имеет отношения к ugmk-патчам). -# WORKFLOW_URL в base смотрит на ns processing — в wb processing развёрнут -# в ns workflow (apps/processing/wb), тоже поправлено. apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: name: documentations-api namespace: documentations + spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: - backend: + documentations-api: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_a9990430 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: documentations-api + + replicaCount: + _default: 3 + + port: + _default: 8080 + + resources: + requests: + cpu: + _default: 300m + memory: + _default: 300Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: documentations-api + + type: + _default: ClusterIP + + port: + _default: 8080 + + targetPort: + _default: 8080 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + volumes: + _default: + - name: documentations-yc-s3-secret + mountPath: + _default: /etc/sarex/yc-s3-storage + readOnly: + _default: true + secret: + secretName: + _default: documentations-yc-s3 + + - name: zitadel-account + mountPath: + _default: /etc/sarex/zitadel + readOnly: + _default: true + secret: + secretName: + _default: zitadel-account + envs: + - name: POSTGRES_ADDRESS + value: + _default: "sarex-vpsql-01.xc.wb.ru" + + - name: POSTGRES_PORT + value: + _default: "5432" + + - name: POSTGRES_DB + value: + _default: "documentations_db" + - name: POSTGRES_POOL_SIZE value: _default: "20" - - name: USE_LEGACY_BIM_FLOW - value: - _default: "true" + - name: ZITADEL_ACCOUNT value: - _default: /vault/secrets/documentations-zitadel-account-json + _default: "/etc/sarex/zitadel/zitadel-account.json" + - name: ZITADEL_DOMAIN value: - _default: zitadel-srx.wb.ru + _default: "zitadel-srx.wb.ru" + - name: USE_ZITADEL value: _default: "1" + - name: FLOWS_URL value: - _default: http://backend-svc.flows.svc.cluster.local:80 + _default: "http://backend-service.flows.svc.cluster.local:8000" + - name: LAST_MASTER_BIM value: _default: "36311" + - name: API_ADDRESS value: - _default: 0.0.0.0:8080 + _default: "0.0.0.0:8080" + - name: API_ADDRESS_FILE value: - _default: 0.0.0.0:8080 + _default: "0.0.0.0:8080" + - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES value: _default: "5" + - name: ENABLE_SQL_QUERY value: _default: "0" + - name: ENABLE_SSL value: _default: "0" + - name: WORKSPACE_V2_EXTERNAL_URL value: - _default: https://srx.wb.ru/workspaces-v2/ + _default: "https://srx.wb.ru/workspaces-v2/" + - name: ENABLE_S3 value: _default: "1" + - name: CONTAINER_REGISTRY value: - _default: cr.yandex/crp3ccidau046kdj8g9q + _default: "cr.yandex/crp3ccidau046kdj8g9q" + - name: ENVIRONMENT value: - _default: production + _default: "production" + - name: LAST_SLAVE_1_BIM value: _default: "1000000" + - name: HOST value: - _default: http://backend-api-svc.documentations.svc.cluster.local:80 + _default: "http://documentations-api.documentations.svc.cluster.local:8080" + - name: FILE_STREAM_HOST value: - _default: srx.wb.ru + _default: "srx.wb.ru" + - name: DOCUMENTATION_URL value: - _default: http://backend-api-svc.documentations.svc.cluster.local:80/ + _default: "http://documentations-api.documentations.svc.cluster.local:8080/" + - name: WORKFLOW_URL value: - _default: http://backend-svc.workflow.svc.cluster.local:80/ + _default: "http://workflows-api-service.workflow.svc.cluster.local:8000/" + - name: WORKSPACE_URL value: - _default: http://backend-svc.workspaces.svc.cluster.local:80/ + _default: "http://workspaces-service.workspaces.svc.cluster.local:8000/" + - name: BIM_API_URL value: - _default: http://backend-svc.bim.svc.cluster.local:80/ + _default: "http://bim-api-service.bim.svc.cluster.local:8080/" + - name: BIM_API_V2_URL value: - _default: http://backend-svc.bim.svc.cluster.local:80/ + _default: "http://backend-service.bim.svc.cluster.local:8000/" + - name: WORKSPACE_BUNDLE_VERSION value: - _default: v1 + _default: "v1" + - name: SYSTEM_LOG_URL value: - _default: http://backend-svc.system-log.svc.cluster.local:80 + _default: "http://api-service.system-log.svc.cluster.local:8000" + - name: DJANGO_HOST value: - _default: http://backend-svc.django.svc.cluster.local:80 + _default: "http://backend.django.svc.cluster.local:8000" + - name: MARKS_PROCESSING_URL value: - _default: http://marks-service:8000 - - name: USE_MARKS_RABBITMQ - value: - _default: "true" - - name: MARKS_RABBITMQ_HOST - value: - _default: rabbitmq.rabbitmq.svc.cluster.local - - name: MARKS_RABBITMQ_PORT - value: - _default: "5672" + _default: "http://marks-service:8000" + - name: PUBLIC_LINK_HOST value: - _default: https://document-link-srx.wb.ru + _default: "https://document-link-srx.wb.ru" + - name: NAMESPACE value: - _default: documentations + _default: "documentations" + - name: DJANGO_ORIGINATOR value: - _default: docs_prod + _default: "docs_prod" + - name: WORKFLOW_IMAGES_VERSION value: - _default: master + _default: "master" + - name: WORKFLOWS_IMAGES_VERSION value: - _default: master + _default: "master" + - name: S3_SERVICE_ACCOUNT value: - _default: /vault/secrets/documentations-s3-account-json + _default: "/etc/sarex/yc-s3-storage/yc-s3-service-account.json" + - name: READ_WRITE_TIMEOUT_FILE_STREAM value: - _default: 6h + _default: "6h" + - name: CACHE_DEFAULT_EXPIRATION value: - _default: 60s + _default: "60s" + - name: ENABLE_SMTP value: _default: "True" + - name: ENABLE_MAILGUN value: _default: "False" + - name: CACHE_CLEANUP_INTERVAL value: - _default: 60s - - name: DOCUMENT_PUBLIC_LINK_JWT_SECRET - value: - _default: "mock" + _default: "60s" + - name: ENABLE_AUTH_JWT_IN_URL value: - _default: "true" + _default: "false" + - name: ENABLE_SIGNATURE_IN_URL value: - _default: "false" + _default: "true" + - name: USE_CACHE_IN_FILE_STREAMER value: - _default: "0" + _default: "1" + - name: VALKEY_ADDR value: - _default: redis:6379 + _default: "redis:6379" + - name: VALKEY_HOST value: - _default: redis + _default: "redis" + - name: VALKEY_PORT value: _default: "6379" + + secretEnvs: + - name: PUBLIC_KEY + secretName: + _default: "public-key" + secretKey: "key" + + - name: DOCUMENT_PUBLIC_LINK_JWT_SECRET + secretName: + _default: "yc-jwt-secret" + secretKey: "secret" + + - name: POSTGRES_USER + secretName: + _default: "postgres-secret" + secretKey: "username" + + - name: POSTGRES_PASSWORD + secretName: + _default: "postgres-secret" + secretKey: "password" + + - name: DJANGO_BASIC_AUTH + secretName: + _default: "django-auth" + secretKey: "key" + + - name: DJANGO_BASIC_AUTH_FOR_GET_USER + secretName: + _default: "django-auth" + secretKey: "key" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/documentations/wb/filestream.yaml b/apps/documentations/wb/filestream.yaml new file mode 100644 index 0000000..f927485 --- /dev/null +++ b/apps/documentations/wb/filestream.yaml @@ -0,0 +1,292 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: documentations-filestream + namespace: documentations + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + documentations-filestream: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:prod_a9990430 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: documentations-filestream + + replicaCount: + _default: 3 + + port: + _default: 8080 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: documentations-filestream + + type: + _default: ClusterIP + + port: + _default: 8080 + + targetPort: + _default: 8080 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + volumes: + _default: + - name: documentations-yc-s3-secret + mountPath: + _default: /etc/sarex/yc-s3-storage + readOnly: + _default: true + secret: + secretName: + _default: documentations-yc-s3 + + - name: zitadel-account + mountPath: + _default: /etc/sarex/zitadel + readOnly: + _default: true + secret: + secretName: + _default: zitadel-account + + envs: + - name: POSTGRES_ADDRESS + value: + _default: "sarex-vpsql-01.xc.wb.ru" + + - name: POSTGRES_PORT + value: + _default: "5432" + + - name: POSTGRES_DB + value: + _default: "documentations_db" + + - name: POSTGRES_POOL_SIZE + value: + _default: "20" + + - name: API_ADDRESS + value: + _default: "0.0.0.0:8080" + + - name: API_ADDRESS_FILE + value: + _default: "0.0.0.0:8080" + + - name: ENABLE_SQL_QUERY + value: + _default: "0" + + - name: ENABLE_SSL + value: + _default: "0" + + - name: ENABLE_S3 + value: + _default: "1" + + - name: ZITADEL_ACCOUNT + value: + _default: "/etc/sarex/zitadel/zitadel-account.json" + + - name: ZITADEL_DOMAIN + value: + _default: "zitadel-srx.wb.ru" + + - name: USE_ZITADEL + value: + _default: "1" + + - name: CONTAINER_REGISTRY + value: + _default: "cr.yandex/crp3ccidau046kdj8g9q" + + - name: ENVIRONMENT + value: + _default: "production" + + - name: HOST + value: + _default: "http://documentations-service.documentations.svc.cluster.local:8080" + + - name: FILE_STREAM_HOST + value: + _default: "srx.wb.ru" + + - name: DOCUMENTATION_URL + value: + _default: "http://documentations-service.documentations.svc.cluster.local:8080/" + + - name: WORKFLOW_URL + value: + _default: "http://workflows-service.workflow.svc.cluster.local:8000/" + + - name: WORKSPACE_URL + value: + _default: "http://workspaces-service.workspaces.svc.cluster.local:8000/" + + - name: BIM_API_URL + value: + _default: "http://bim-api-service.bim.svc.cluster.local:8080/" + + - name: BIM_API_V2_URL + value: + _default: "http://backend-service.bim.svc.cluster.local:8000/" + + - name: ENABLE_AUTH_JWT_IN_URL + value: + _default: "false" + + - name: ENABLE_SIGNATURE_IN_URL + value: + _default: "true" + + - name: WORKSPACE_BUNDLE_VERSION + value: + _default: "v1" + + - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES + value: + _default: "5" + + - name: DJANGO_HOST + value: + _default: "http://backend.django.svc.cluster.local:8000" + + - name: NAMESPACE + value: + _default: "sarex-documentations" + + - name: DJANGO_ORIGINATOR + value: + _default: "docs_prod" + + - name: WORKFLOW_IMAGES_VERSION + value: + _default: "master" + + - name: WORKFLOWS_IMAGES_VERSION + value: + _default: "master" + + - name: S3_SERVICE_ACCOUNT + value: + _default: "/etc/sarex/yc-s3-storage/yc-s3-service-account.json" + + - name: READ_WRITE_TIMEOUT_FILE_STREAM + value: + _default: "6h" + + - name: CACHE_DEFAULT_EXPIRATION + value: + _default: "60s" + + - name: CACHE_CLEANUP_INTERVAL + value: + _default: "60s" + + - name: USE_CACHE_IN_FILE_STREAMER + value: + _default: "1" + + - name: VALKEY_ADDR + value: + _default: "redis:6379" + + - name: VALKEY_HOST + value: + _default: "redis" + + - name: VALKEY_PORT + value: + _default: "6379" + + secretEnvs: + - name: DJANGO_BASIC_AUTH_FOR_GET_USER + secretName: + _default: "django-auth" + secretKey: "key" + + - name: DOCUMENT_PUBLIC_LINK_JWT_SECRET + secretName: + _default: "yc-jwt-secret" + secretKey: "secret" + + - name: POSTGRES_USER + secretName: + _default: "postgres-secret" + secretKey: "username" + + - name: POSTGRES_PASSWORD + secretName: + _default: "postgres-secret" + secretKey: "password" + + - name: DJANGO_BASIC_AUTH + secretName: + _default: "django-auth" + secretKey: "key" + + - name: PUBLIC_KEY + secretName: + _default: "public-key" + secretKey: "key" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/documentations/wb/frontend-public-link.yaml b/apps/documentations/wb/frontend-public-link.yaml new file mode 100644 index 0000000..ccc4ff2 --- /dev/null +++ b/apps/documentations/wb/frontend-public-link.yaml @@ -0,0 +1,113 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: frontend-public-link + namespace: documentations + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + frontend-public-link: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/document-link-frontend:wb_cb2027ce + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: frontend-public-link + + replicaCount: + _default: 1 + + port: + _default: 3000 + + command: + _default: ["npm", "start"] + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: frontend-service-public-link + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 3000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + volumes: + _default: + - name: envfile + mountPath: + _default: /app/.env.local + subPath: + _default: .env.local + readOnly: + _default: true + secret: + secretName: + _default: documentations-publiclink-jwt-secret + items: + - key: .env + path: + _default: .env.local + + envs: + - name: NODE_ENV + value: + _default: "production" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/documentations/wb/frontend-static.yaml b/apps/documentations/wb/frontend-static.yaml new file mode 100644 index 0000000..a276d6e --- /dev/null +++ b/apps/documentations/wb/frontend-static.yaml @@ -0,0 +1,88 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: documentation-frontend-static + namespace: documentations + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + documentation-frontend-static: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/documentation-frontend-app:brusnika_ce5555d3 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: documentation-frontend-static + + replicaCount: + _default: 1 + + port: + _default: 80 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: documentation-frontend-static-service + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 80 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/documentations/wb/kustomization.yaml b/apps/documentations/wb/kustomization.yaml index 5e3cbd4..e8899c2 100644 --- a/apps/documentations/wb/kustomization.yaml +++ b/apps/documentations/wb/kustomization.yaml @@ -3,13 +3,12 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: documentations resources: - - ../base -patches: - - path: api.yaml - target: - kind: HelmRelease - name: documentations-api - - path: pdm.yaml - target: - kind: HelmRelease - name: pdm-api + - api.yaml + - filestream.yaml + - pdm-api.yaml + - pdf-markings.yaml + - pdf-markings-amqp.yaml + - frontend-public-link.yaml + - frontend-static.yaml + - redis.yaml + - stamp-verification.yaml diff --git a/apps/documentations/wb/pdf-markings-amqp.yaml b/apps/documentations/wb/pdf-markings-amqp.yaml new file mode 100644 index 0000000..c0dfe8d --- /dev/null +++ b/apps/documentations/wb/pdf-markings-amqp.yaml @@ -0,0 +1,193 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: pdf-markings-amqp + namespace: documentations + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + api: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_3ab263be + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: pdf-markings-amqp + + replicaCount: + _default: 1 + + port: + _default: 8000 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + volumes: + _default: + - name: yc-s3 + mountPath: + _default: /etc/sarex/yc-s3-storage + readOnly: + _default: true + secret: + secretName: + _default: yc-s3 + + envs: + - name: MARKS_APP__LOG_LEVEL + value: + _default: "INFO" + + - name: MARKS_CRYPTO__HASHING_ALGO + value: + _default: "md_gost12_256" + + - name: MARKS_DOCUMENTS_DB__HOST + value: + _default: "sarex-vpsql-01.xc.wb.ru" + + - name: MARKS_DOCUMENTS_DB__PORT + value: + _default: "5432" + + - name: MARKS_DOCUMENTS_DB__DATABASE + value: + _default: "documentations_db" + + - name: MARKS_DOCUMENTS_DB__SSLMODE + value: + _default: "disable" + + - name: MARKS_QR__REDIRECT_URL + value: + _default: "https://stamp-verification-srx.wb.ru/" + + - name: MARKS_QR__BASE_DOCUMENT_URL + value: + _default: "https://srx.wb.ru" + + - name: MARKS_S3__USE_SSL + value: + _default: "false" + + - name: MARKS_S3__SSL_VERIFY + value: + _default: "false" + + - name: MARKS_S3__REGION + value: + _default: "ru-central1" + + - name: MARKS_S3__DEFAULT_BUCKET + value: + _default: "documentations-stage-1-sarex-new" + + - name: MARKS_RABBITMQ__ROUTING__INPUT_QUEUE + value: + _default: "pdf_markings_input" + + secretEnvs: + - name: MARKS_DOCUMENTS_DB__USERNAME + secretName: + _default: "postgres-secret" + secretKey: "username" + + - name: MARKS_DOCUMENTS_DB__PASSWORD + secretName: + _default: "postgres-secret" + secretKey: "password" + + - name: MARKS_S3__URL + secretName: + _default: "yc-s3" + secretKey: "endpoint_url" + + - name: MARKS_S3__ACCESS_KEY + secretName: + _default: "yc-s3" + secretKey: "key_id" + + - name: MARKS_S3__SECRET_KEY + secretName: + _default: "yc-s3" + secretKey: "access_key" + + - name: MARKS_RABBITMQ__HOST + secretName: + _default: "rabbitmq" + secretKey: "host" + + - name: MARKS_RABBITMQ__PORT + secretName: + _default: "rabbitmq" + secretKey: "port" + + - name: MARKS_RABBITMQ__USERNAME + secretName: + _default: "rabbitmq" + secretKey: "username" + + - name: MARKS_RABBITMQ__PASSWORD + secretName: + _default: "rabbitmq" + secretKey: "password" + + - name: MARKS_RABBITMQ__VHOST + secretName: + _default: "rabbitmq" + secretKey: "vhost" + + - name: MARKS_RABBITMQ__HEARTBEAT_SECONDS + secretName: + _default: "rabbitmq" + secretKey: "heartbeat" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/documentations/wb/pdf-markings.yaml b/apps/documentations/wb/pdf-markings.yaml new file mode 100644 index 0000000..48e136e --- /dev/null +++ b/apps/documentations/wb/pdf-markings.yaml @@ -0,0 +1,231 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: pdf-markings + namespace: documentations + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + pdf-markings: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings:prod_7d892636 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: pdf-markings + + replicaCount: + _default: 1 + + port: + _default: 8000 + + resources: + requests: + cpu: + _default: "2" + memory: + _default: 8Gi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: marks-service + + type: + _default: ClusterIP + + port: + _default: 8000 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + volumes: + _default: + - name: yc-s3 + mountPath: + _default: /etc/sarex/yc-s3-storage + readOnly: + _default: true + secret: + secretName: + _default: documentations-yc-s3 + + envs: + - name: APP_NAME + value: + _default: "pdm_v2" + + - name: VERIFY + value: + _default: "False" + + - name: APP_VERSION + value: + _default: "0.0.1" + + - name: LOG_LEVEL + value: + _default: "INFO" + + - name: HTTP_PORT + value: + _default: "8000" + + - name: DOC_POSTGRES_HOST + value: + _default: "sarex-vpsql-01.xc.wb.ru" + + - name: DOC_POSTGRES_PORT + value: + _default: "5432" + + - name: DOC_POSTGRES_DB + value: + _default: "documentations_db" + + - name: DOC_POSTGRES_POOL_SIZE + value: + _default: "10" + + - name: DOC_POSTGRES_SSL_MODE + value: + _default: "disable" + + - name: API_ADDRESS + value: + _default: "0.0.0.0:8000" + + - name: DATABASE_SSL_MODE + value: + _default: "disable" + + - name: YANDEX_S3_USE_SSL + value: + _default: "0" + + - name: ENVIRONMENT + value: + _default: "production" + + - name: YANDEX_S3_ACCOUNT_PATH + value: + _default: "/etc/sarex/yc-s3-storage/yc-s3-service-account.json" + + - name: REDIRECT_URL_QR + value: + _default: "https://stamp-verification-srx.wb.ru/" + + - name: BASE_DOCUMENT_URL + value: + _default: "https://srx.wb.ru" + + secretEnvs: + - name: DOC_POSTGRES_USER + secretName: + _default: "postgres-secret" + secretKey: "username" + + - name: DOC_POSTGRES_PASSWORD + secretName: + _default: "postgres-secret" + secretKey: "password" + + - name: YANDEX_S3_ENDPOINT_URL + secretName: + _default: "yc-s3" + secretKey: "endpoint_url" + + - name: YANDEX_S3_SECRET_ACCESS_KEY + secretName: + _default: "yc-s3" + secretKey: "access_key" + + - name: YANDEX_S3_ACCESS_KEY_ID + secretName: + _default: "yc-s3" + secretKey: "key_id" + + - name: RABBITMQ_HOST + secretName: + _default: "rabbitmq" + secretKey: "host" + + - name: RABBITMQ_PORT + secretName: + _default: "rabbitmq" + secretKey: "port" + + - name: RABBITMQ_USERNAME + secretName: + _default: "rabbitmq" + secretKey: "username" + + - name: RABBITMQ_PASSWORD + secretName: + _default: "rabbitmq" + secretKey: "password" + + - name: RABBITMQ_VHOST + secretName: + _default: "rabbitmq" + secretKey: "vhost" + + - name: RABBITMQ_HEARTBEAT + secretName: + _default: "rabbitmq" + secretKey: "heartbeat" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/documentations/wb/pdm-api.yaml b/apps/documentations/wb/pdm-api.yaml new file mode 100644 index 0000000..723242b --- /dev/null +++ b/apps/documentations/wb/pdm-api.yaml @@ -0,0 +1,342 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: pdm-api + namespace: documentations + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + pdm-api: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/pdmv2:prod_38958427 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: pdm-api + + replicaCount: + _default: 3 + + port: + _default: 8080 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: pdm-api + + type: + _default: ClusterIP + + port: + _default: 8080 + + targetPort: + _default: 8080 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + volumes: + _default: + - name: documentations-yc-s3-secret + mountPath: + _default: /etc/sarex/yc-s3-storage + readOnly: + _default: true + secret: + secretName: + _default: documentations-yc-s3 + + envs: + - name: USE_EXPERIMENTAL + value: + _default: "true" + + - name: API_ADDRESS + value: + _default: "0.0.0.0:8080" + + - name: API_ADDRESS_FILE + value: + _default: "0.0.0.0:8080" + + - name: BUCKET_NAME + value: + _default: "attachments-storage" + + - name: API_HOST_PREFIX + value: + _default: "/" + + - name: APP_NAME + value: + _default: "pdm_v2" + + - name: APP_VERSION + value: + _default: "0.0.1" + + - name: ENABLE_PERMISSIONS_FILTER + value: + _default: "1" + + - name: PERMISSIONS_FILTER_COMPANIES + value: + _default: "[1]" + + - name: TRANSMITTALS_ENABLE + value: + _default: "false" + + - name: DRAWINGS_INTERNAL_URL + value: + _default: "http://drawings-api-service.drawings.svc.cluster.local:80" + + - name: ATTACHMENTS_URL + value: + _default: "http://attachments-service.attachments.svc.cluster.local:8000" + + - name: BIM_API_V2_URL + value: + _default: "http://backend-service.bim.svc.cluster.local:8000/" + + - name: BIM_V2_HOST + value: + _default: "http://backend-service.bim.svc.cluster.local:8000/" + + - name: CACHE_CLEANUP_INTERVAL + value: + _default: "60s" + + - name: CACHE_DEFAULT_EXPIRATION + value: + _default: "60s" + + - name: DJANGO_HOST + value: + _default: "http://backend.django.svc.cluster.local:8000" + + - name: DJANGO_ORIGINATOR + value: + _default: "docs_prod" + + - name: DOCUMENTATION_URL + value: + _default: "http://documentations-api.documentations.svc.cluster.local:8080/" + + - name: EAV_URL + value: + _default: "http://eav-service.eav.svc.cluster.local:8000" + + - name: ENABLE_OBSERVABILITY + value: + _default: "false" + + - name: ENABLE_S3 + value: + _default: "1" + + - name: ENABLE_SSL + value: + _default: "0" + + - name: ENVIRONMENT + value: + _default: "prod" + + - name: FLOWS_URL + value: + _default: "http://backend-service.flows.svc.cluster.local:8000" + + - name: HEIGHT_THUMB_ATTACHMENTS + value: + _default: "300" + + - name: HEIGHT_THUMB_STATES + value: + _default: "73" + + - name: HTTP_PORT + value: + _default: "8080" + + - name: INSPECTIONS_URL + value: + _default: "http://inspections-service.inspections.svc.cluster.local:80" + + - name: LOG_LEVEL + value: + _default: "INFO" + + - name: OBSERVABILITY_COLLECTOR_ENDPOINT + value: + _default: "temp" + + - name: POSTGRES_ADDRESS + value: + _default: "sarex-vpsql-01.xc.wb.ru" + + - name: POSTGRES_DB + value: + _default: "documentations_db" + + - name: POSTGRES_POOL_SIZE + value: + _default: "20" + + - name: TRANSMITTALS_BASE_URL + value: + _default: "mock" + + - name: POSTGRES_PORT + value: + _default: "5432" + + - name: READ_WRITE_TIMEOUT_FILE_STREAM + value: + _default: "6h" + + - name: RELEASES_URL + value: + _default: "https://gitlab.com" + + - name: REMARKS_URL + value: + _default: "http://remarks-static-service.remarks.svc.cluster.local:8080/remarks" + + - name: RESOURCES_URL + value: + _default: "http://resources-service.resources.svc.cluster.local:8000" + + - name: S3_SERVICE_ACCOUNT + value: + _default: "/etc/sarex/yc-s3-storage/yc-s3-service-account.json" + + - name: STATES_URL + value: + _default: "http://workspaces-service.workspaces.svc.cluster.local:8000/" + + - name: SUBSCRIPTIONS_URL + value: + _default: "http://sarex-subscriptions-service.subscriptions.svc.cluster.local:80" + + - name: SYSTEM_LOG_URL + value: + _default: "http://api-service.system-log.svc.cluster.local:8000" + + - name: TARGET_URL + value: + _default: "http://backend.django.svc.cluster.local:8000" + + - name: USE_CACHE_IN_FILE_STREAMER + value: + _default: "1" + + - name: USE_SUBSCRIPTIONS + value: + _default: "false" + + - name: WIDTH_THUMB_ATTACHMENTS + value: + _default: "300" + + - name: WIDTH_THUMB_STATES + value: + _default: "120" + + - name: WORKFLOWS_IMAGES_VERSION + value: + _default: "master" + + - name: WORKFLOW_IMAGES_VERSION + value: + _default: "master" + + - name: WORKFLOW_URL + value: + _default: "http://workflows-api-service.workflow.svc.cluster.local:8000/" + + - name: WORKSPACE_BUNDLE_VERSION + value: + _default: "v1" + + - name: WORKSPACE_URL + value: + _default: "http://workspaces-service.workspaces.svc.cluster.local:8000/" + + secretEnvs: + - name: RELEASES_TOKEN + secretName: + _default: "releases-token" + secretKey: "key" + + - name: POSTGRES_USER + secretName: + _default: "postgres-secret" + secretKey: "username" + + - name: POSTGRES_PASSWORD + secretName: + _default: "postgres-secret" + secretKey: "password" + + - name: DJANGO_BASIC_AUTH + secretName: + _default: "django-auth" + secretKey: "key" + + - name: PUBLIC_KEY + secretName: + _default: "public-key" + secretKey: "key" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/documentations/wb/pdm.yaml b/apps/documentations/wb/pdm.yaml deleted file mode 100644 index 1341285..0000000 --- a/apps/documentations/wb/pdm.yaml +++ /dev/null @@ -1,176 +0,0 @@ ---- -# Патч pdm-api для контура wb. -# -# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch), -# поэтому здесь продублирован весь набор из apps/documentations/base/pdm.yaml. -# Единственное изменение — WORKFLOW_URL: в base смотрит на ns processing, -# в wb processing развёрнут в ns workflow (apps/processing/wb). -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: pdm-api - namespace: documentations -spec: - values: - services: - backend: - envs: - - name: USE_EXPERIMENTAL - value: - _default: "true" - - name: POSTGRES_POOL_SIZE - value: - _default: "20" - - name: TRANSMITTALS_BASE_URL - value: - _default: mock - - name: API_ADDRESS - value: - _default: 0.0.0.0:8080 - - name: API_ADDRESS_FILE - value: - _default: 0.0.0.0:8080 - - name: BUCKET_NAME - value: - _default: attachments-storage - - name: API_HOST_PREFIX - value: - _default: / - - name: APP_NAME - value: - _default: pdm_v2 - - name: APP_VERSION - value: - _default: "0.0.1" - - name: ENABLE_PERMISSIONS_FILTER - value: - _default: "1" - - name: PERMISSIONS_FILTER_COMPANIES - value: - _default: "[1]" - - name: TRANSMITTALS_ENABLE - value: - _default: "false" - - name: DRAWINGS_INTERNAL_URL - value: - _default: http://drawings-api-service.drawings.svc.cluster.local:80 - - name: ATTACHMENTS_URL - value: - _default: http://attachments-service.attachments.svc.cluster.local:8000 - - name: BIM_API_V2_URL - value: - _default: http://backend-svc.bim.svc.cluster.local:80/ - - name: BIM_V2_HOST - value: - _default: http://backend-svc.bim.svc.cluster.local:80/ - - name: CACHE_CLEANUP_INTERVAL - value: - _default: 60s - - name: CACHE_DEFAULT_EXPIRATION - value: - _default: 60s - - name: DJANGO_HOST - value: - _default: http://backend-svc.django.svc.cluster.local:80 - - name: DJANGO_ORIGINATOR - value: - _default: docs_prod - - name: DOCUMENTATION_URL - value: - _default: http://backend-api-svc.documentations.svc.cluster.local:80/ - - name: EAV_URL - value: - _default: http://backend-svc.eav.svc.cluster.local:80 - - name: ENABLE_OBSERVABILITY - value: - _default: "false" - - name: ENABLE_S3 - value: - _default: "1" - - name: ENABLE_SSL - value: - _default: "0" - - name: ENVIRONMENT - value: - _default: prod - - name: FLOWS_URL - value: - _default: http://backend-svc.flows.svc.cluster.local:80 - - name: HEIGHT_THUMB_ATTACHMENTS - value: - _default: "300" - - name: HEIGHT_THUMB_STATES - value: - _default: "73" - - name: HTTP_PORT - value: - _default: "8080" - - name: INSPECTIONS_URL - value: - _default: http://inspections-service.inspections.svc.cluster.local:80 - - name: LOG_LEVEL - value: - _default: INFO - - name: NOTES_URL - value: - _default: "" - - name: OBSERVABILITY_COLLECTOR_ENDPOINT - value: - _default: temp - - name: READ_WRITE_TIMEOUT_FILE_STREAM - value: - _default: 6h - - name: RELEASES_URL - value: - _default: https://gitlab.com - - name: REMARKS_URL - value: - _default: http://remarks-static-service.remarks.svc.cluster.local:8080/remarks - - name: RESOURCES_URL - value: - _default: http://iam-backend.iam.svc.cluster.local:8000 - - name: S3_SERVICE_ACCOUNT - value: - _default: /vault/secrets/documentations-s3-account-json - - name: STATES_URL - value: - _default: http://backend-svc.workspaces.svc.cluster.local:80/ - - name: SUBSCRIPTIONS_URL - value: - _default: http://backend-svc.subscriptions.svc.cluster.local:80 - - name: SYSTEM_LOG_URL - value: - _default: http://api-service.system-log.svc.cluster.local:80 - - name: TARGET_URL - value: - _default: http://backend-svc.django.svc.cluster.local:80 - - name: USE_CACHE_IN_FILE_STREAMER - value: - _default: "1" - - name: USE_SUBSCRIPTIONS - value: - _default: "false" - - name: WIDTH_THUMB_ATTACHMENTS - value: - _default: "300" - - name: WIDTH_THUMB_STATES - value: - _default: "120" - - name: WORKFLOWS_IMAGES_VERSION - value: - _default: master - - name: WORKFLOW_IMAGES_VERSION - value: - _default: master - - name: RELEASES_TOKEN - value: - _default: "mock" - - name: WORKFLOW_URL - value: - _default: http://backend-svc.workflow.svc.cluster.local:80/ - - name: WORKSPACE_BUNDLE_VERSION - value: - _default: v1 - - name: WORKSPACE_URL - value: - _default: http://backend-svc.workspaces.svc.cluster.local:80/ diff --git a/apps/documentations/wb/redis.yaml b/apps/documentations/wb/redis.yaml new file mode 100644 index 0000000..c30cd95 --- /dev/null +++ b/apps/documentations/wb/redis.yaml @@ -0,0 +1,88 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: redis + namespace: documentations + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + redis: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/redis:latest + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: redis + + replicaCount: + _default: 1 + + port: + _default: 6379 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: redis + + type: + _default: ClusterIP + + port: + _default: 6379 + + targetPort: + _default: 6379 + + portName: + _default: tcp + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/documentations/wb/stamp-verification.yaml b/apps/documentations/wb/stamp-verification.yaml new file mode 100644 index 0000000..19206de --- /dev/null +++ b/apps/documentations/wb/stamp-verification.yaml @@ -0,0 +1,90 @@ +--- +# stamp-verification — отдельное приложение (apps/stamp-verification), +# в wb развёрнуто в ns documentations, а не в своём собственном неймспейсе. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: stamp-verification + namespace: documentations + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + stamp-verification: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/stamp-verification-frontend:e11a8f90be462fc325ff99c8c35a8a418815c27b + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: stamp-verification + + replicaCount: + _default: 1 + + port: + _default: 8080 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: stamp-verification-frontend-service + + type: + _default: ClusterIP + + port: + _default: 8080 + + targetPort: + _default: 8080 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/drawings/wb/backend.yaml b/apps/drawings/wb/backend.yaml new file mode 100644 index 0000000..b22690c --- /dev/null +++ b/apps/drawings/wb/backend.yaml @@ -0,0 +1,120 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: drawings-api + namespace: drawings + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + drawings-api: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/drawings-api:015e68e1b2a3dcc13f0b405e1f761b154a825d24 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: drawings-api + + replicaCount: + _default: 1 + + port: + _default: 8080 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: drawings-api-service + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 8080 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + envs: + - name: POSTGRES_ADDRESS + value: + _default: "sarex-vpsql-01.xc.wb.ru:5432" + + - name: POSTGRES_DB + value: + _default: "drawings_db" + + - name: POSTGRES_POOL_SIZE + value: + _default: "3" + + - name: API_ADDRESS + value: + _default: "0.0.0.0:8080" + + - name: ENABLE_SSL + value: + _default: "0" + + secretEnvs: + - name: POSTGRES_USER + secretName: + _default: "postgres-secret" + secretKey: "username" + + - name: POSTGRES_PASSWORD + secretName: + _default: "postgres-secret" + secretKey: "password" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/drawings/wb/kustomization.yaml b/apps/drawings/wb/kustomization.yaml index fd6815f..851a163 100644 --- a/apps/drawings/wb/kustomization.yaml +++ b/apps/drawings/wb/kustomization.yaml @@ -3,4 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: drawings resources: - - ../base + - backend.yaml diff --git a/apps/eav/wb/backend.yaml b/apps/eav/wb/backend.yaml new file mode 100644 index 0000000..bbb0220 --- /dev/null +++ b/apps/eav/wb/backend.yaml @@ -0,0 +1,191 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: eav + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + backend: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/eav:prod_0fb73247 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: backend + + replicaCount: + _default: 1 + + port: + _default: 8000 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: eav-service + + type: + _default: ClusterIP + + port: + _default: 8000 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + volumes: + _default: + - name: django-configmap + mountPath: + _default: /server/config/settings/production.py + subPath: + _default: production.py + readOnly: + _default: true + configMap: + name: + _default: django-configmap + items: + - key: production.py + path: + _default: production.py + + - name: kafka-cert-volume + mountPath: + _default: /usr/local/share/ca-certificates + readOnly: + _default: true + configMap: + name: + _default: kafka-cert + + envs: + - name: KAFKA_USERNAME + value: + _default: "sarex" + + - name: KAFKA_SSL_CAFILE + value: + _default: "/usr/local/share/ca-certificates/kafka.crt" + + - name: KAFKA_HOST + value: + _default: "wb-stage-kafka-bootstrap.kafka.svc.cluster.local:9093" + + - name: KAFKA_ENABLED + value: + _default: "False" + + - name: ASSETS_TOPIC + value: + _default: "sarex" + + - name: DJANGO_SETTINGS_MODULE + value: + _default: "config.settings.production" + + - name: DJANGO_POSTGRES_HOST + value: + _default: "sarex-vpsql-01.xc.wb.ru" + + - name: DJANGO_POSTGRES_DATABASE + value: + _default: "eav_db" + + - name: YC_S3_ENDPOINT_URL + value: + _default: "http://minio-svc.minio.svc.cluster.local:9000" + + - name: YC_S3_BUCKET_NAME + value: + _default: "eav" + + secretEnvs: + - name: KAFKA_PASSWORD + secretName: + _default: "kafka-cred" + secretKey: "password" + + - name: DJANGO_POSTGRES_USER + secretName: + _default: "postgres-secret" + secretKey: "username" + + - name: DJANGO_POSTGRES_PASSWORD + secretName: + _default: "postgres-secret" + secretKey: "password" + + - name: JWT_PRIVATE_KEY + secretName: + _default: "backend-secret" + secretKey: "ssh_private.key" + + - name: JWT_PUBLIC_KEY + secretName: + _default: "backend-secret" + secretKey: "ssh_public.key" + + - name: YC_S3_ACCESS_KEY_ID + secretName: + _default: "s3-secret" + secretKey: "login" + + - name: YC_S3_SECRET_ACCESS_KEY + secretName: + _default: "s3-secret" + secretKey: "password" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/eav/wb/django-configmap.yaml b/apps/eav/wb/django-configmap.yaml new file mode 100644 index 0000000..21786ee --- /dev/null +++ b/apps/eav/wb/django-configmap.yaml @@ -0,0 +1,147 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: django-configmap + namespace: eav +data: + production.py: | + # production.py + + from .base import * + from datetime import timedelta + import os + from django.core.exceptions import ImproperlyConfigured + + INSTALLED_APPS.append("corsheaders") + #MIDDLEWARE = ["corsheaders.middleware.CorsMiddleware"] + MIDDLEWARE + + # DEBUG SETTINGS START + # --------------------------------------------------------------------------------------------------------------------- + DEBUG = True + ALLOWED_HOSTS = ['*'] + # --------------------------------------------------------------------------------------------------------------------- + # DEBUG SETTINGS END + + # DATABASE SETTINGS START + # --------------------------------------------------------------------------------------------------------------------- + DATABASES = { + "default": { + "ENGINE": "django.db.backends.postgresql", + "NAME": os.getenv("DJANGO_POSTGRES_DATABASE"), + "USER": os.getenv("DJANGO_POSTGRES_USER"), + "PASSWORD": os.getenv("DJANGO_POSTGRES_PASSWORD"), + "HOST": os.getenv("DJANGO_POSTGRES_HOST"), + "PORT": "5432", + } + } + # --------------------------------------------------------------------------------------------------------------------- + # DATABASE SETTINGS END + + # RESPONSE HEADERS START + # --------------------------------------------------------------------------------------------------------------------- + CORS_ORIGIN_ALLOW_ALL = True + + CORS_ALLOWED_ORIGINS = [ + "https://srx.wb.ru", + ] + + CORS_TRUSTED_ORIGINS = [ + "https://srx.wb.ru", + ] + + CSRF_TRUSTED_ORIGINS = [ + "https://srx.wb.ru", + ] + + CORS_ALLOW_METHODS = ( + 'DELETE', + 'GET', + 'OPTIONS', + 'PATCH', + 'POST', + 'PUT', + ) + + CORS_ALLOW_HEADERS = ( + 'accept', + 'accept-encoding', + 'authorization', + 'content-type', + 'user-agent', + 'x-csrftoken', + 'x-requested-with', + 'x-token', + 'Bearer' + ) + # --------------------------------------------------------------------------------------------------------------------- + # RESPONSE HEADERS END + + REST_FRAMEWORK = { + "DEFAULT_PAGINATION_CLASS": ( + "rest_framework.pagination.LimitOffsetPagination" + ), + "DEFAULT_SCHEMA_CLASS": "rest_framework.schemas.coreapi.AutoSchema", + "PAGE_SIZE": 10000, + "DEFAULT_FILTER_BACKENDS": [ + "django_filters.rest_framework.DjangoFilterBackend" + ], + "DEFAULT_AUTHENTICATION_CLASSES": [ + "core.auth.ZitadelJWTAuthentication", + "rest_framework_simplejwt.authentication.JWTAuthentication", + "rest_framework.authentication.SessionAuthentication", + "rest_framework.authentication.BasicAuthentication", + ], + "DEFAULT_PERMISSION_CLASSES": [ + "rest_framework.permissions.AllowAny", + ] + } + + # JWT SETTINGS START + # --------------------------------------------------------------------------------------------------------------------- + def get_env_variable(var_name, default=None): + try: + return os.getenv(var_name, default) + except KeyError: + error_msg = f"Set the {var_name} environment variable" + if default: + return default + raise ImproperlyConfigured(error_msg) + + SIMPLE_JWT_ISSUER = get_env_variable("SIMPLE_JWT_ISSUER", default="django") + + SIMPLE_JWT = { + "ACCESS_TOKEN_LIFETIME": timedelta(minutes=5), + "REFRESH_TOKEN_LIFETIME": timedelta(days=1), + "ROTATE_REFRESH_TOKENS": False, + "UPDATE_LAST_LOGIN": False, + + "ALGORITHM": "RS512", + "SIGNING_KEY": get_env_variable("JWT_PRIVATE_KEY").replace("\\\n", "\n"), + "VERIFYING_KEY": get_env_variable("JWT_PUBLIC_KEY").replace("\\\n", "\n"), + "AUDIENCE": None, + "ISSUER": SIMPLE_JWT_ISSUER, + + "AUTH_HEADER_TYPES": ("Bearer",), + "AUTH_HEADER_NAME": "HTTP_AUTHORIZATION", + "USER_ID_FIELD": "id", + "USER_ID_CLAIM": "user_id", + + "AUTH_TOKEN_CLASSES": ("rest_framework_simplejwt.tokens.AccessToken",), + "TOKEN_TYPE_CLAIM": "token_type", + + "JTI_CLAIM": "jti", + + "SLIDING_TOKEN_REFRESH_EXP_CLAIM": "refresh_exp", + "SLIDING_TOKEN_LIFETIME": timedelta(minutes=5), + "SLIDING_TOKEN_REFRESH_LIFETIME": timedelta(days=1), + } + # --------------------------------------------------------------------------------------------------------------------- + # JWT SETTINGS END + + STATIC_ROOT = '/static/' + STATIC_URL = '/static/' + STATICFILES_STORAGE = 'django.contrib.staticfiles.storage.StaticFilesStorage' + + SESSION_COOKIE_NAME = 'eav-sessionid' + CSRF_COOKIE_NAME = 'eav-csrftoken' diff --git a/apps/eav/wb/kafka-cert-configmap.yaml b/apps/eav/wb/kafka-cert-configmap.yaml new file mode 100644 index 0000000..cefaf22 --- /dev/null +++ b/apps/eav/wb/kafka-cert-configmap.yaml @@ -0,0 +1,38 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: kafka-cert + namespace: eav +data: + kafka.crt: | + -----BEGIN CERTIFICATE----- + MIIFLTCCAxWgAwIBAgIUA5L48eHPMqNFYE5wIgaOmWgG3okwDQYJKoZIhvcNAQEN + BQAwLTETMBEGA1UECgwKaW8uc3RyaW16aTEWMBQGA1UEAwwNY2x1c3Rlci1jYSB2 + MDAeFw0yNTA2MDQxMTMzMTRaFw0yNjA2MDQxMTMzMTRaMC0xEzARBgNVBAoMCmlv + LnN0cmltemkxFjAUBgNVBAMMDWNsdXN0ZXItY2EgdjAwggIiMA0GCSqGSIb3DQEB + AQUAA4ICDwAwggIKAoICAQDV2NBVwnXISH9i8K4KxSd2AThwgQyRKyeIfcqeYZ4F + 7FguEUI7uEtoWd4uO8DsIzoMoLYv5L1DfhNYUFWN3XYQd4XVFnwYQYbwspdC1L8G + u0T7943gRRRomcNP8n5nycfeZgZgmz9IS8vmxgRh4ao0kcCW49uBQMd706087UAI + qaRJTcabTZq1LTeoH9AOAyT/nawKm+1H5VmrMUBjzz9xKVXF0sCrhjYoZoM4x+fY + AphtxZDB21ZhEcHBbytEQkEm0QTbUP4xbu95yqY6goYi9S9R1uMgVZ9DoJVwyqLm + /3ZGPjd9VmdBPO/zE/Bj890DjyKS7AXo9d+Iyv4M2QD1jA+5j4JyHzk7Lroz+HTg + mwVpcVGafBWIC4qFt7C3UYt6IV64/MA2v9gxTIdJvOBZxKUiMl7f65jKNEntF6is + 86QCkjhvt34AThEoGx8SPjVr3sOBuneqcybeSYLyEWFg9Z1mWfMLHlA/Fp/Y2wpM + w1ZXj6uAa/UNUAIfkaLTOKHHaCCVD2G3Vkm94NHOJmDj6ze8P0J0H+Ub6ULD7hHr + 8obOSk9OvxoxVzE+UW7DyEL6YD8MBVUQKJIQVgZmpT4akWyz8bNhFRzgTnKAhwNN + ATrGmjfX/wj7tCpy/PoJjEiu54sXW5xplBIz/ZgYHrPkyrbhQxsRozgQ+UIMIIbJ + /wIDAQABo0UwQzAdBgNVHQ4EFgQUkU4HKndgWxhcXMAe5XBc4OJwSgcwEgYDVR0T + AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQENBQADggIB + AFLi5QLawZollou3+m5kYcBe5F8xKG5NlgNmKyIREnwD2AP4xrr2tNFbmP2hpEl4 + bWJJ84IHlKjpYxFLboWzgtW/JvdxcEh0K/x8/7cOD3Kk9d/LR9muj57mFYSQGlbo + g0+lHNuLam8xGcnGVV5VdfcjFz72/q92ndTlJmz+v6OneTJvIypKoBmNKF25alz9 + pR2sTwoG0Pcwm30u/uS6pOewQ4sTiniOcc1MFYF7tl/Zz9Mqza8Rer0B5nm8lE/J + Yo9UaEXyVLM8Y5kSOkxMlOK+8/UMeY/lcQYpd5tYVpvarnoPCjmUjt4iVw26ZsAH + y4/vNW+wX+Uauarik1jHL/SauAjS3FbJoH06BBnji7J/Rud2DtSd+vVZrIBLJkaH + +Xg/roD3xKx0XmhLJmPvxGrkyehbhkbJkPKCHa9P56rnev3MYjyy+SV7Vp8Dq+HF + Wkswl3QUPWx9reuvF2KMyt04Tw94UAxCUGkX5qg7Dq5d0Fj/AcIrFdLTCV8eG/UI + 1kKRxmZ2/ALINBOlfJOVVovKBlWpPACs8iy6XreOXtoQfzoG2F9Vo3Jmzjpqsmz0 + 9Ao4s2vcz3UuDtBhpwGp4N3zroyst/kQjtZirj4cS7fu75tB5N5mQ/tTwg0Tiw+Y + XIdxeE73V5DAf4Dd5V1VdCbA6oQv5qJYvinYydyx4x3V + -----END CERTIFICATE----- diff --git a/apps/eav/wb/kustomization.yaml b/apps/eav/wb/kustomization.yaml index 1ce8404..d103f00 100644 --- a/apps/eav/wb/kustomization.yaml +++ b/apps/eav/wb/kustomization.yaml @@ -3,4 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: eav resources: - - ../base + - django-configmap.yaml + - kafka-cert-configmap.yaml + - backend.yaml diff --git a/apps/faas/wb/backend.yaml b/apps/faas/wb/backend.yaml index 5bf59e4..f108977 100644 --- a/apps/faas/wb/backend.yaml +++ b/apps/faas/wb/backend.yaml @@ -1,21 +1,87 @@ --- -# Патч backend для контура wb. -# -# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch), -# поэтому здесь продублирован весь набор из apps/faas/base/backend.yaml. -# -# В base BASE_HOST/DJANGO_HOST/REVIEWS_HOST/GATEWAY_HOST/DOCUMENTATIONS_HOST -# смотрят на тестовый контур contour.infra.sarex.tech — для wb это srx.wb.ru -# (ugmk эти поля тоже не переопределял — тот же неисправленный дефолт). apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: name: export-reviews namespace: faas + spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: - backend: + export-reviews: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/export-reviews:prod_c4cae4ee + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: export-reviews + + replicaCount: + _default: 1 + + port: + _default: 8000 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: export-reviews-service + + type: + _default: ClusterIP + + port: + _default: 8000 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + envs: - name: BASE_HOST value: @@ -39,7 +105,7 @@ spec: - name: EAV_HOST value: - _default: "http://backend-svc.eav.svc.cluster.local:80" + _default: "http://eav-service.eav.svc.cluster.local:8000" - name: TRANSMITTALS_INTERNAL_HOST value: @@ -72,3 +138,8 @@ spec: - name: TIMEOUT value: _default: "180" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/faas/wb/kustomization.yaml b/apps/faas/wb/kustomization.yaml index dfaf222..e461d2d 100644 --- a/apps/faas/wb/kustomization.yaml +++ b/apps/faas/wb/kustomization.yaml @@ -3,9 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: faas resources: - - ../base -patches: - - path: backend.yaml - target: - kind: HelmRelease - name: export-reviews + - backend.yaml diff --git a/apps/flows/wb/authentication-configmap.yaml b/apps/flows/wb/authentication-configmap.yaml new file mode 100644 index 0000000..6321f17 --- /dev/null +++ b/apps/flows/wb/authentication-configmap.yaml @@ -0,0 +1,93 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: authentication + namespace: flows +data: + authentication.py: | + import httpx + + from fastapi import Request, status + from itsdangerous import URLSafeTimedSerializer, BadData as BadDataError + from sqladmin.authentication import AuthenticationBackend + + from flow.config import settings + + + class AdminAuthentication(AuthenticationBackend): + def get_serializer(self) -> URLSafeTimedSerializer: + return URLSafeTimedSerializer( + secret_key=settings.admin_panel.secret_key, + ) + + async def login(self, request: Request) -> bool: + form = await request.form() + username, password = form["username"], form["password"] + token_payload = { + 'is_django_user': False, + 'user_id': None, + } + # получаем данные о юзере + if True: + #print("OK"*30) + # client: httpx.AsyncClient = settings.django.get_async_session(token=settings.django.token) + # async with client as session: + # auth_response = await session.post(url='/login/', json={ + # 'username': username, + # 'password': password, + # }, follow_redirects=False) + # print("*"*30, auth_response.status_code ,settings.django.host, username, password,"*"*30) + # if auth_response.status_code != status.HTTP_200_OK: + # return False + + # django_response = await session.get(url='/client/settings/') + # print("$"*30, django_response.status_code, "$"*30) + # if django_response.status_code != status.HTTP_200_OK: + # return False + if username == "68Lvh2PsHd5y" and password == "Hnzvh2PsHd5yI1v": + #user = django_response.json() + has_access = True + if not has_access: + return False + + user_id = 2 + + token_payload = { + 'is_django_user': True, + 'user_id': user_id, + } + else: + token_payload = { + 'is_django_user': False, + 'user_id': None, + } + + token = self.get_serializer().dumps(token_payload) + + request.session.update({"token": token}) + return True + + async def logout(self, request: Request) -> bool: + request.session.clear() + return True + + async def authenticate(self, request: Request) -> bool: + token = request.session.get("token") + + if not token: + return False + + try: + payload = self.get_serializer().loads(token, max_age=settings.admin_panel.token_max_age) + except (BadDataError, KeyError): + return False + + is_django_user = payload.get('is_django_user') + if settings.django.use != is_django_user: + return False + + return True + + + authentication_backend = AdminAuthentication(secret_key=settings.admin_panel.secret_key) diff --git a/apps/flows/wb/backend.yaml b/apps/flows/wb/backend.yaml index 9f9bb4d..1abfade 100644 --- a/apps/flows/wb/backend.yaml +++ b/apps/flows/wb/backend.yaml @@ -1,19 +1,104 @@ --- -# Патч backend для контура wb. -# -# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch), -# поэтому здесь продублирован весь набор из apps/flows/base/backend.yaml. -# Единственное изменение — WORKFLOWS_HOST: в base смотрит на ns processing, -# в wb processing развёрнут в ns workflow (apps/processing/wb). apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: name: backend namespace: flows + spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: backend: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_2a439111 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: backend + + replicaCount: + _default: 1 + + port: + _default: 8000 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: backend-service + + type: + _default: ClusterIP + + port: + _default: 8000 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + volumes: + _default: + - name: authentication + mountPath: + _default: /opt/src/flow/admin/authentication.py + subPath: + _default: authentication.py + readOnly: + _default: true + configMap: + name: + _default: authentication + items: + - key: authentication.py + path: + _default: authentication.py + envs: - name: LOG_LEVEL value: @@ -29,15 +114,15 @@ spec: - name: EAV_HOST value: - _default: "http://backend-svc.eav.svc.cluster.local:80" + _default: "http://eav-service.eav.svc.cluster.local:8000" - name: DJANGO_HOST value: - _default: "http://backend-svc.django.svc.cluster.local:80/api" + _default: "http://backend.django.svc.cluster.local:8000/api" - name: PLANNING_HOST value: - _default: "http://backend-svc.pm.svc.cluster.local:8000/api/pm/msp" + _default: "http://backend-service.pm.svc.cluster.local:8000/api/pm/msp" - name: PLANNING_USE value: @@ -45,11 +130,11 @@ spec: - name: DOCUMENTATION_HOST value: - _default: "http://backend-api-svc.documentations.svc.cluster.local:80/internal/v1" + _default: "http://documentations-api.documentations.svc.cluster.local:8080/internal/v1" - name: DOCUMENTATION_EXTERNAL_HOST value: - _default: "http://backend-api-svc.documentations.svc.cluster.local:80/api/v1" + _default: "http://documentations-api.documentations.svc.cluster.local:8080/api/v1" - name: ENABLE_ANALYTICS value: @@ -73,11 +158,27 @@ spec: - name: GATEWAY_URL value: - _default: "http://pdm-svc.documentations.svc.cluster.local:80" + _default: "http://pdm-api.documentations.svc.cluster.local:8080" + + - name: PG_HOST + value: + _default: "sarex-vpsql-01.xc.wb.ru" + + - name: PG_PORT + value: + _default: "5432" + + - name: RABBITMQ_HOST + value: + _default: "rabbitmq.rabbitmq.svc.cluster.local" + + - name: RABBITMQ_PORT + value: + _default: "5672" - name: RESOURCE_URL value: - _default: "http://iam-backend.iam.svc.cluster.local:8000" + _default: "http://resources-service.resources.svc.cluster.local:8000" - name: SERVICE_HOST value: @@ -87,6 +188,22 @@ spec: value: _default: "mail.rwb.ru" + - name: DOCUMENTATION_PG_PORT + value: + _default: "5432" + + - name: PROXY_PATH_PREFIX + value: + _default: "/flows" + + - name: DOCUMENTATION_PG_DATABASE + value: + _default: "documentations_db" + + - name: DOCUMENTATION_PG_HOST + value: + _default: "sarex-vpsql-01.xc.wb.ru" + - name: CHECKLIST_HOST value: _default: "http://checklists-backend-service.checklists.svc.cluster.local:80" @@ -105,7 +222,7 @@ spec: - name: WORKFLOWS_HOST value: - _default: "http://backend-svc.workflow.svc.cluster.local:80/api/v1" + _default: "http://workflows-api-service.workflow.svc.cluster.local:8000/api/v1" - name: WORKFLOWS_TIMEOUT value: @@ -114,3 +231,64 @@ spec: - name: DOCUMENTATION_TIMEOUT value: _default: "60" + + secretEnvs: + - name: ADMIN_PANEL_SECRET_KEY + secretName: + _default: "admin-secret" + secretKey: "key" + + - name: JWT_PUBLIC_KEY + secretName: + _default: "jwt-secret" + secretKey: "public_key" + + - name: DOCUMENTATION_PG_USERNAME + secretName: + _default: "postgres-secret-documentations" + secretKey: "username" + + - name: DOCUMENTATION_PG_PASSWORD + secretName: + _default: "postgres-secret-documentations" + secretKey: "password" + + - name: DJANGO_TOKEN + secretName: + _default: "django-secret" + secretKey: "token" + + - name: PG_DB + secretName: + _default: "postgres-secret" + secretKey: "database" + + - name: PG_LOGIN + secretName: + _default: "postgres-secret" + secretKey: "username" + + - name: PG_PASSWORD + secretName: + _default: "postgres-secret" + secretKey: "password" + + - name: RABBITMQ_USERNAME + secretName: + _default: "rabbitmq-secret" + secretKey: "username" + + - name: RABBITMQ_PASSWORD + secretName: + _default: "rabbitmq-secret" + secretKey: "password" + + - name: RABBITMQ_VHOST + secretName: + _default: "rabbitmq-secret" + secretKey: "vhost" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/flows/wb/celery.yaml b/apps/flows/wb/celery.yaml new file mode 100644 index 0000000..b1b90b4 --- /dev/null +++ b/apps/flows/wb/celery.yaml @@ -0,0 +1,308 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: celery + namespace: flows + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + celery: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_2a439111 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: celery + + replicaCount: + _default: 1 + + port: + _default: 8000 + + command: + _default: ["celery", "-A", "src.worker", "worker", "-l", "INFO", "-E", "--concurrency=1", "-Q", "flow"] + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + envs: + - name: LOG_LEVEL + value: + _default: "DEBUG" + + - name: FLOWS_HOST + value: + _default: "http://backend-service.flows.svc.cluster.local:8000" + + - name: DOCUMENTATION_PG_PORT + value: + _default: "5432" + + - name: DOCUMENTATION_PG_DATABASE + value: + _default: "documentations_db" + + - name: DOCUMENTATION_PG_HOST + value: + _default: "sarex-vpsql-01.xc.wb.ru" + + - name: BASE_HOST + value: + _default: "https://lk.srx.wb.ru:30443" + + - name: CELERY_QUEUE + value: + _default: "flow" + + - name: RESOURCES_HOST + value: + _default: "http://resources-service.resources.svc.cluster.local:8000/" + + - name: DJANGO_HOST + value: + _default: "http://backend.django.svc.cluster.local:8000/api" + + - name: DOCUMENTATION_HOST + value: + _default: "http://documentations-api.documentations.svc.cluster.local:8080/internal/v1" + + - name: DOCUMENTATION_EXTERNAL_HOST + value: + _default: "http://documentations-api.documentations.svc.cluster.local:8080/api/v1" + + - name: ENABLE_ANALYTICS + value: + _default: "1" + + - name: FLOWS_DB_HOST + value: + _default: "sarex-vpsql-01.xc.wb.ru" + + - name: FLOWS_DB_PORT + value: + _default: "5432" + + - name: ISSUES_DB_PORT + value: + _default: "5432" + + - name: ISSUES_DB_HOST + value: + _default: "sarex-vpsql-01.xc.wb.ru" + + - name: ENABLE_CELERY + value: + _default: "1" + + - name: ENABLE_MAILGUN + value: + _default: "0" + + - name: ENABLE_METRICS + value: + _default: "0" + + - name: FROM_EMAIL + value: + _default: "wb@wb.ru" + + - name: GATEWAY_URL + value: + _default: "http://pdm-api.documentations.svc.cluster.local:8080" + + - name: PG_HOST + value: + _default: "sarex-vpsql-01.xc.wb.ru" + + - name: PG_PORT + value: + _default: "5432" + + - name: RABBITMQ_HOST + value: + _default: "rabbitmq.rabbitmq.svc.cluster.local" + + - name: RABBITMQ_PORT + value: + _default: "5672" + + - name: DJANGO_BASE_HOST + value: + _default: "https://srx.wb.ru" + + - name: RESOURCE_URL + value: + _default: "http://resources-service.resources.svc.cluster.local:8000" + + - name: SERVICE_HOST + value: + _default: "https://lk.srx.wb.ru:30443/flows/api/v1" + + - name: SMTP_HOST + value: + _default: "smtp-relay.wb.com" + + - name: SMTP_PORT + value: + _default: "587" + + - name: SYNC_RESOURCE_ID + value: + _default: "1" + + - name: TIMEOUT + value: + _default: "120" + + - name: WORKFLOWS_HOST + value: + _default: "http://workflows-api-service.workflow.svc.cluster.local:8000/api/v1" + + - name: WORKFLOWS_TIMEOUT + value: + _default: "60" + + - name: DOCUMENTATION_TIMEOUT + value: + _default: "60" + + secretEnvs: + - name: ADMIN_PANEL_SECRET_KEY + secretName: + _default: "admin-secret" + secretKey: "key" + + - name: JWT_PUBLIC_KEY + secretName: + _default: "jwt-secret" + secretKey: "public_key" + + - name: DOCUMENTATION_PG_USERNAME + secretName: + _default: "postgres-secret-documentations" + secretKey: "username" + + - name: DOCUMENTATION_PG_PASSWORD + secretName: + _default: "postgres-secret-documentations" + secretKey: "password" + + - name: FLOWS_DB_DB + secretName: + _default: "postgres-secret" + secretKey: "database" + + - name: FLOWS_DB_USERNAME + secretName: + _default: "postgres-secret" + secretKey: "username" + + - name: FLOWS_DB_PASSWORD + secretName: + _default: "postgres-secret" + secretKey: "password" + + - name: ISSUES_DB_DB + secretName: + _default: "postgres-secret-issues" + secretKey: "database" + + - name: ISSUES_DB_USERNAME + secretName: + _default: "postgres-secret-issues" + secretKey: "username" + + - name: ISSUES_DB_PASSWORD + secretName: + _default: "postgres-secret-issues" + secretKey: "password" + + - name: DJANGO_AUTH + secretName: + _default: "django-secret" + secretKey: "token" + + - name: DJANGO_TOKEN + secretName: + _default: "django-secret" + secretKey: "token" + + - name: PG_DB + secretName: + _default: "postgres-secret" + secretKey: "database" + + - name: PG_LOGIN + secretName: + _default: "postgres-secret" + secretKey: "username" + + - name: PG_PASSWORD + secretName: + _default: "postgres-secret" + secretKey: "password" + + - name: RABBITMQ_USERNAME + secretName: + _default: "rabbitmq-secret" + secretKey: "username" + + - name: RABBITMQ_PASSWORD + secretName: + _default: "rabbitmq-secret" + secretKey: "password" + + - name: RABBITMQ_VHOST + secretName: + _default: "rabbitmq-secret" + secretKey: "vhost" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/flows/wb/frontend.yaml b/apps/flows/wb/frontend.yaml new file mode 100644 index 0000000..8388034 --- /dev/null +++ b/apps/flows/wb/frontend.yaml @@ -0,0 +1,95 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: frontend + namespace: flows + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + frontend: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_5b2bd144 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: frontend + + replicaCount: + _default: 1 + + port: + _default: 80 + + resources: + requests: + cpu: + _default: 100m + memory: + _default: 100Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: frontend-service + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 80 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/flows/wb/kustomization.yaml b/apps/flows/wb/kustomization.yaml index e90dac9..ad62e58 100644 --- a/apps/flows/wb/kustomization.yaml +++ b/apps/flows/wb/kustomization.yaml @@ -3,9 +3,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: flows resources: - - ../base -patches: - - path: backend.yaml - target: - kind: HelmRelease - name: backend + - authentication-configmap.yaml + - backend.yaml + - celery.yaml + - frontend.yaml diff --git a/apps/inspections/wb/backend.yaml b/apps/inspections/wb/backend.yaml index c1a1cc9..ef989d7 100644 --- a/apps/inspections/wb/backend.yaml +++ b/apps/inspections/wb/backend.yaml @@ -1,19 +1,87 @@ --- -# Патч backend для контура wb. -# -# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch), -# поэтому здесь продублирован весь набор из apps/inspections/base/backend.yaml. -# Единственное изменение — WORKFLOWS_URL: в base смотрит на ns processing, -# в wb processing развёрнут в ns workflow (apps/processing/wb). apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: - name: backend + name: inspections-backend namespace: inspections + spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: - backend: + api: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:production_1a33f6f4 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: inspections-backend + + replicaCount: + _default: 1 + + port: + _default: 8000 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: sarex-inspections-service + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + envs: - name: DEBUG value: @@ -73,15 +141,18 @@ spec: - name: EAV_URL value: - _default: "http://backend-svc.eav.svc.cluster.local:80" + _default: "http://eav-service.eav" - name: EAV_TIMEOUT value: _default: "30" + # В дампе кластера значение было http://workflows-service.processing-prod — + # тот же неймспейс, что в вопросе про processing/workflow: реальный + # ns у processing в wb — workflow. - name: WORKFLOWS_URL value: - _default: "http://backend-svc.workflow.svc.cluster.local:80" + _default: "http://workflows-service.workflow" - name: WORKFLOWS_TIMEOUT value: @@ -110,3 +181,54 @@ spec: - name: MAILER_TIMEOUT value: _default: "30" + + secretEnvs: + - name: DATABASE_USER + secretName: + _default: "pg-secret" + secretKey: "username" + + - name: DATABASE_PORT + secretName: + _default: "pg-secret" + secretKey: "port" + + - name: DATABASE_NAME + secretName: + _default: "pg-secret" + secretKey: "database" + + - name: DATABASE_HOST + secretName: + _default: "pg-secret" + secretKey: "host" + + - name: DATABASE_PASSWORD + secretName: + _default: "pg-secret" + secretKey: "password" + + - name: KAFKA_HOST + secretName: + _default: "kafka-secret" + secretKey: "host" + + - name: KAFKA_USERNAME + secretName: + _default: "kafka-secret" + secretKey: "username" + + - name: KAFKA_PASSWORD + secretName: + _default: "kafka-secret" + secretKey: "password" + + - name: SAREX_BACKEND_AUTH + secretName: + _default: "sarex-backend-auth-secret" + secretKey: "key" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/inspections/wb/kustomization.yaml b/apps/inspections/wb/kustomization.yaml index e278709..101613f 100644 --- a/apps/inspections/wb/kustomization.yaml +++ b/apps/inspections/wb/kustomization.yaml @@ -3,9 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: inspections resources: - - ../base -patches: - - path: backend.yaml - target: - kind: HelmRelease - name: backend + - backend.yaml diff --git a/apps/issues/wb/app-configmap.yaml b/apps/issues/wb/app-configmap.yaml new file mode 100644 index 0000000..dbe2035 --- /dev/null +++ b/apps/issues/wb/app-configmap.yaml @@ -0,0 +1,55 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: app + namespace: issues +data: + app.py: | + import ssl + from django.conf import settings + from faststream import FastStream + from faststream.kafka import KafkaBroker + from faststream.security import BaseSecurity + + + def get_broker() -> KafkaBroker: + ssl_context = ssl.create_default_context( + cafile=settings.KAFKA_SSL_CAFILE, + ) + + # Сертификат передаем, но hostname не проверяем + ssl_context.check_hostname = False + + # Для самоподписанного сертификата + ssl_context.verify_mode = ssl.CERT_NONE + + security = BaseSecurity( + ssl_context=ssl_context, + use_ssl=True, + ) + + broker = KafkaBroker( + bootstrap_servers=[settings.KAFKA_HOST], + security=security, + ) + + return broker + + + def get_consumer_broker() -> KafkaBroker: + broker = get_broker() + + from kafka_app.consumers import eav_router + + broker.include_router(eav_router) + + return broker + + + def configure_app() -> FastStream: + broker = get_consumer_broker() + + app = FastStream(broker) + + return app diff --git a/apps/issues/wb/backend.yaml b/apps/issues/wb/backend.yaml deleted file mode 100644 index 5756181..0000000 --- a/apps/issues/wb/backend.yaml +++ /dev/null @@ -1,85 +0,0 @@ ---- -# Патч backend для контура wb. -# -# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch), -# поэтому здесь продублирован весь набор из apps/issues/base/backend.yaml. -# podAnnotations — map, мержится по ключам, поэтому переопределён только -# agent-inject-template-issues-s3. -# -# В base AERO_*/SAREX_API смотрят на тестовый контур contour.infra.sarex.tech — -# для wb это srx.wb.ru (apps/issues/base/celery.yaml уже использует его как -# дефолт — переносим то же значение сюда, в base/backend.yaml почему-то ещё -# contour). MinIO-бакет в base тоже неверный (rfi вместо issues) — из -# terraform 1.yaml (infrastructure.minio.apps.issues для wb): -# client.endpoint=https://minio-srx.wb.ru, buckets[0].name=issues. -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: backend - namespace: issues -spec: - values: - services: - backend: - envs: - - name: ENVIRONMENT - value: - _default: "production" - - - name: AERO_PUBLIC_HOST - value: - _default: "https://srx.wb.ru" - - - name: AERO_HOST - value: - _default: "https://srx.wb.ru" - - - name: BASE_AERO_URL - value: - _default: "https://srx.wb.ru" - - - name: BASE_AUTH_URL - value: - _default: "http://backend-svc.django.svc.cluster.local:80" - - - name: WORKFLOWS_HOST - value: - _default: "http://backend-svc.workflow.svc.cluster.local:80" - - - name: WORKFLOWS_URL - value: - _default: "http://backend-svc.workflow.svc.cluster.local:80" - - - name: RESOURCES_API_HOST - value: - _default: "http://iam-backend.iam.svc.cluster.local:8000" - - - name: EAV_HOST - value: - _default: "http://backend-svc.eav.svc.cluster.local:80" - - - name: SAREX_API - value: - _default: "https://srx.wb.ru" - - - name: DOCUMENTATIONS_URL - value: - _default: "http://documentations-api-svc.documentations.svc.cluster.local:80" - - - name: DJANGO_SETTINGS_MODULE - value: - _default: "config.settings.production" - - - name: API_ADDRESS - value: - _default: "8000" - - podAnnotations: - _default: - vault.hashicorp.com/agent-inject-template-issues-s3: |- - {{- with secret "secrets/data/minio/apps/issues" -}} - YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} - YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} - YC_S3_BUCKET_NAME=issues - YC_S3_ENDPOINT_URL=https://minio-srx.wb.ru - {{- end -}} diff --git a/apps/issues/wb/celery.yaml b/apps/issues/wb/celery.yaml index 05bb0e1..b4e2e23 100644 --- a/apps/issues/wb/celery.yaml +++ b/apps/issues/wb/celery.yaml @@ -1,25 +1,281 @@ --- -# Патч celery для контура wb. -# -# В apps/issues/base/celery.yaml AERO_*/SAREX_API уже "https://srx.wb.ru" — -# трогать envs не нужно. Но MinIO-бакет в base тоже неверный (rfi вместо -# issues) — правим только podAnnotations (map, мержится по ключам). -# См. подробности в apps/issues/wb/backend.yaml. apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: name: celery namespace: issues + spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: celery: - podAnnotations: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_17c438aa + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: celery + + replicaCount: + _default: 1 + + port: + _default: 8000 + + command: + _default: ["celery", "-A", "config", "worker", "-l", "info", "-E"] + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + volumes: _default: - vault.hashicorp.com/agent-inject-template-issues-s3: |- - {{- with secret "secrets/data/minio/apps/issues" -}} - YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} - YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} - YC_S3_BUCKET_NAME=issues - YC_S3_ENDPOINT_URL=https://minio-srx.wb.ru - {{- end -}} + - name: kafka-cert-volume + mountPath: + _default: /usr/local/share/ca-certificates + readOnly: + _default: true + configMap: + name: + _default: kafka-cert + + - name: app + mountPath: + _default: /src/kafka_app/app.py + subPath: + _default: app.py + readOnly: + _default: true + configMap: + name: + _default: app + items: + - key: app.py + path: + _default: app.py + + - name: uwsgi-configmap + mountPath: + _default: /opt/server/uwsgi.ini + subPath: + _default: uwsgi.ini + readOnly: + _default: true + configMap: + name: + _default: uwsgi-configmap + items: + - key: uwsgi.ini + path: + _default: uwsgi.ini + + - name: production-configmap + mountPath: + _default: /src/config/settings/production.py + subPath: + _default: production.py + readOnly: + _default: true + configMap: + name: + _default: production-configmap + items: + - key: production.py + path: + _default: production.py + + envs: + - name: ENVIRONMENT + value: + _default: "production" + + - name: AERO_PUBLIC_HOST + value: + _default: "https://srx.wb.ru" + + - name: AERO_HOST + value: + _default: "https://srx.wb.ru" + + - name: BASE_AERO_URL + value: + _default: "https://srx.wb.ru" + + - name: BASE_AUTH_URL + value: + _default: "https://srx.wb.ru" + + - name: WORKFLOWS_HOST + value: + _default: "http://workflows-api-service.workflow.svc.cluster.local:8000" + + - name: WORKFLOWS_URL + value: + _default: "http://workflows-api-service.workflow.svc.cluster.local:8000" + + - name: RESOURCES_API_HOST + value: + _default: "http://resources-service.resources.svc.cluster.local:8000" + + - name: EAV_HOST + value: + _default: "http://eav-service.eav.svc.cluster.local:8000" + + - name: USE_NOTIFICATIONS + value: + _default: "True" + + - name: ENABLE_MAILGUN + value: + _default: "False" + + - name: SAREX_API + value: + _default: "https://srx.wb.ru" + + - name: DOCUMENTATIONS_URL + value: + _default: "http://documentations-api.documentations.svc.cluster.local:8080" + + - name: DJANGO_SETTINGS_MODULE + value: + _default: "config.settings.production" + + - name: DATABASE_HOST + value: + _default: "sarex-vpsql-01.xc.wb.ru" + + - name: DATABASE_PORT + value: + _default: "5432" + + - name: API_ADDRESS + value: + _default: "8000" + + - name: RABBITMQ_HOSTNAME + value: + _default: "rabbitmq.rabbitmq.svc.cluster.local:5672" + + secretEnvs: + - name: YC_S3_ACCESS_KEY_ID + secretName: + _default: "yc-s3-secret" + secretKey: "key_id" + + - name: YC_S3_SECRET_ACCESS_KEY + secretName: + _default: "yc-s3-secret" + secretKey: "access_key" + + - name: YC_S3_BUCKET_NAME + secretName: + _default: "yc-s3-secret" + secretKey: "storage_bucket_name" + + - name: YC_S3_ENDPOINT_URL + secretName: + _default: "yc-s3-secret" + secretKey: "endpoint_url" + + - name: DJANGO_BASIC_AUTH + secretName: + _default: "django-auth" + secretKey: "key" + + - name: SAREX_USERNAME + secretName: + _default: "sarex-auth" + secretKey: "username" + + - name: SAREX_PASSWORD + secretName: + _default: "sarex-auth" + secretKey: "password" + + - name: DATABASE_USER + secretName: + _default: "postgres-secret" + secretKey: "username" + + - name: DATABASE_PASSWORD + secretName: + _default: "postgres-secret" + secretKey: "password" + + - name: DATABASE_NAME + secretName: + _default: "postgres-secret" + secretKey: "database" + + - name: RABBITMQ_VHOST + secretName: + _default: "rabbitmq-secret" + secretKey: "vhost" + + - name: RABBITMQ_USERNAME + secretName: + _default: "rabbitmq-secret" + secretKey: "username" + + - name: RABBITMQ_PASSWORD + secretName: + _default: "rabbitmq-secret" + secretKey: "password" + + - name: JWT_PRIVATE_KEY + secretName: + _default: "backend-secret" + secretKey: "ssh_private.key" + + - name: JWT_PUBLIC_KEY + secretName: + _default: "backend-secret" + secretKey: "ssh_public.key" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/issues/wb/issues.yaml b/apps/issues/wb/issues.yaml new file mode 100644 index 0000000..066c79a --- /dev/null +++ b/apps/issues/wb/issues.yaml @@ -0,0 +1,270 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: issues + namespace: issues + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + issues: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/issues:wb_497411b7 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: issues + + replicaCount: + _default: 1 + + port: + _default: 8000 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: issues-service + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + volumes: + _default: + - name: kafka-cert-volume + mountPath: + _default: /usr/local/share/ca-certificates + readOnly: + _default: true + configMap: + name: + _default: kafka-cert + + - name: uwsgi-configmap + mountPath: + _default: /opt/server/uwsgi.ini + subPath: + _default: uwsgi.ini + readOnly: + _default: true + configMap: + name: + _default: uwsgi-configmap + items: + - key: uwsgi.ini + path: + _default: uwsgi.ini + + - name: production-configmap + mountPath: + _default: /src/config/settings/production.py + subPath: + _default: production.py + readOnly: + _default: true + configMap: + name: + _default: production-configmap + items: + - key: production.py + path: + _default: production.py + + envs: + - name: ENVIRONMENT + value: + _default: "production" + + - name: AERO_PUBLIC_HOST + value: + _default: "https://srx.wb.ru" + + - name: AERO_HOST + value: + _default: "https://srx.wb.ru" + + - name: BASE_AERO_URL + value: + _default: "https://srx.wb.ru" + + - name: BASE_AUTH_URL + value: + _default: "http://backend.django.svc.cluster.local:8000" + + - name: WORKFLOWS_HOST + value: + _default: "http://workflows-api-service.workflow.svc.cluster.local:8000" + + - name: WORKFLOWS_URL + value: + _default: "http://workflows-api-service.workflow.svc.cluster.local:8000" + + - name: RESOURCES_API_HOST + value: + _default: "http://resources-service.resources.svc.cluster.local:8000" + + - name: EAV_HOST + value: + _default: "http://eav-service.eav.svc.cluster.local:8000" + + - name: SAREX_API + value: + _default: "https://srx.wb.ru" + + - name: DOCUMENTATIONS_URL + value: + _default: "http://documentations-api.documentations.svc.cluster.local:8080" + + - name: DJANGO_SETTINGS_MODULE + value: + _default: "config.settings.production" + + - name: DATABASE_HOST + value: + _default: "sarex-vpsql-01.xc.wb.ru" + + - name: DATABASE_PORT + value: + _default: "5432" + + - name: API_ADDRESS + value: + _default: "8000" + + - name: RABBITMQ_HOSTNAME + value: + _default: "rabbitmq.rabbitmq.svc.cluster.local:5672" + + secretEnvs: + - name: YC_S3_ACCESS_KEY_ID + secretName: + _default: "yc-s3-secret" + secretKey: "key_id" + + - name: YC_S3_SECRET_ACCESS_KEY + secretName: + _default: "yc-s3-secret" + secretKey: "access_key" + + - name: YC_S3_BUCKET_NAME + secretName: + _default: "yc-s3-secret" + secretKey: "storage_bucket_name" + + - name: YC_S3_ENDPOINT_URL + secretName: + _default: "yc-s3-secret" + secretKey: "endpoint_url" + + - name: DJANGO_BASIC_AUTH + secretName: + _default: "django-auth" + secretKey: "key" + + - name: SAREX_USERNAME + secretName: + _default: "sarex-auth" + secretKey: "username" + + - name: SAREX_PASSWORD + secretName: + _default: "sarex-auth" + secretKey: "password" + + - name: DATABASE_USER + secretName: + _default: "postgres-secret" + secretKey: "username" + + - name: DATABASE_PASSWORD + secretName: + _default: "postgres-secret" + secretKey: "password" + + - name: DATABASE_NAME + secretName: + _default: "postgres-secret" + secretKey: "database" + + - name: RABBITMQ_VHOST + secretName: + _default: "rabbitmq-secret" + secretKey: "vhost" + + - name: RABBITMQ_USERNAME + secretName: + _default: "rabbitmq-secret" + secretKey: "username" + + - name: RABBITMQ_PASSWORD + secretName: + _default: "rabbitmq-secret" + secretKey: "password" + + - name: JWT_PRIVATE_KEY + secretName: + _default: "backend-secret" + secretKey: "ssh_private.key" + + - name: JWT_PUBLIC_KEY + secretName: + _default: "backend-secret" + secretKey: "ssh_public.key" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/issues/wb/kafka-cert-configmap.yaml b/apps/issues/wb/kafka-cert-configmap.yaml new file mode 100644 index 0000000..50a2645 --- /dev/null +++ b/apps/issues/wb/kafka-cert-configmap.yaml @@ -0,0 +1,38 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: kafka-cert + namespace: issues +data: + kafka.crt: | + -----BEGIN CERTIFICATE----- + MIIFLTCCAxWgAwIBAgIUA5L48eHPMqNFYE5wIgaOmWgG3okwDQYJKoZIhvcNAQEN + BQAwLTETMBEGA1UECgwKaW8uc3RyaW16aTEWMBQGA1UEAwwNY2x1c3Rlci1jYSB2 + MDAeFw0yNTA2MDQxMTMzMTRaFw0yNjA2MDQxMTMzMTRaMC0xEzARBgNVBAoMCmlv + LnN0cmltemkxFjAUBgNVBAMMDWNsdXN0ZXItY2EgdjAwggIiMA0GCSqGSIb3DQEB + AQUAA4ICDwAwggIKAoICAQDV2NBVwnXISH9i8K4KxSd2AThwgQyRKyeIfcqeYZ4F + 7FguEUI7uEtoWd4uO8DsIzoMoLYv5L1DfhNYUFWN3XYQd4XVFnwYQYbwspdC1L8G + u0T7943gRRRomcNP8n5nycfeZgZgmz9IS8vmxgRh4ao0kcCW49uBQMd706087UAI + qaRJTcabTZq1LTeoH9AOAyT/nawKm+1H5VmrMUBjzz9xKVXF0sCrhjYoZoM4x+fY + AphtxZDB21ZhEcHBbytEQkEm0QTbUP4xbu95yqY6goYi9S9R1uMgVZ9DoJVwyqLm + /3ZGPjd9VmdBPO/zE/Bj890DjyKS7AXo9d+Iyv4M2QD1jA+5j4JyHzk7Lroz+HTg + mwVpcVGafBWIC4qFt7C3UYt6IV64/MA2v9gxTIdJvOBZxKUiMl7f65jKNEntF6is + 86QCkjhvt34AThEoGx8SPjVr3sOBuneqcybeSYLyEWFg9Z1mWfMLHlA/Fp/Y2wpM + w1ZXj6uAa/UNUAIfkaLTOKHHaCCVD2G3Vkm94NHOJmDj6ze8P0J0H+Ub6ULD7hHr + 8obOSk9OvxoxVzE+UW7DyEL6YD8MBVUQKJIQVgZmpT4akWyz8bNhFRzgTnKAhwNN + ATrGmjfX/wj7tCpy/PoJjEiu54sXW5xplBIz/ZgYHrPkyrbhQxsRozgQ+UIMIIbJ + /wIDAQABo0UwQzAdBgNVHQ4EFgQUkU4HKndgWxhcXMAe5XBc4OJwSgcwEgYDVR0T + AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQENBQADggIB + AFLi5QLawZollou3+m5kYcBe5F8xKG5NlgNmKyIREnwD2AP4xrr2tNFbmP2hpEl4 + bWJJ84IHlKjpYxFLboWzgtW/JvdxcEh0K/x8/7cOD3Kk9d/LR9muj57mFYSQGlbo + g0+lHNuLam8xGcnGVV5VdfcjFz72/q92ndTlJmz+v6OneTJvIypKoBmNKF25alz9 + pR2sTwoG0Pcwm30u/uS6pOewQ4sTiniOcc1MFYF7tl/Zz9Mqza8Rer0B5nm8lE/J + Yo9UaEXyVLM8Y5kSOkxMlOK+8/UMeY/lcQYpd5tYVpvarnoPCjmUjt4iVw26ZsAH + y4/vNW+wX+Uauarik1jHL/SauAjS3FbJoH06BBnji7J/Rud2DtSd+vVZrIBLJkaH + +Xg/roD3xKx0XmhLJmPvxGrkyehbhkbJkPKCHa9P56rnev3MYjyy+SV7Vp8Dq+HF + Wkswl3QUPWx9reuvF2KMyt04Tw94UAxCUGkX5qg7Dq5d0Fj/AcIrFdLTCV8eG/UI + 1kKRxmZ2/ALINBOlfJOVVovKBlWpPACs8iy6XreOXtoQfzoG2F9Vo3Jmzjpqsmz0 + 9Ao4s2vcz3UuDtBhpwGp4N3zroyst/kQjtZirj4cS7fu75tB5N5mQ/tTwg0Tiw+Y + XIdxeE73V5DAf4Dd5V1VdCbA6oQv5qJYvinYydyx4x3V + -----END CERTIFICATE----- diff --git a/apps/issues/wb/kustomization.yaml b/apps/issues/wb/kustomization.yaml index 787f553..9a4fe9d 100644 --- a/apps/issues/wb/kustomization.yaml +++ b/apps/issues/wb/kustomization.yaml @@ -3,13 +3,12 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: issues resources: - - ../base -patches: - - path: backend.yaml - target: - kind: HelmRelease - name: backend - - path: celery.yaml - target: - kind: HelmRelease - name: celery + - app-configmap.yaml + - production-configmap.yaml + - uwsgi-configmap.yaml + - kafka-cert-configmap.yaml + - issues.yaml + - celery.yaml + - redis.yaml + - static.yaml + - remarks-static.yaml diff --git a/apps/issues/wb/production-configmap.yaml b/apps/issues/wb/production-configmap.yaml new file mode 100644 index 0000000..5925aa4 --- /dev/null +++ b/apps/issues/wb/production-configmap.yaml @@ -0,0 +1,143 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: production-configmap + namespace: issues +data: + production.py: | + from datetime import timedelta + import os + from .base import * + + # DEBUG SETTINGS START + # ----------------------------------------------------------------------------- + DEBUG = True + # ----------------------------------------------------------------------------- + + TEST_MODE = False + #USE_NOTIFICATIONS = False + AWS_S3_VERIFY=False + + # SECRETS SETTINGS START + # ----------------------------------------------------------------------------- + SECRET_KEY = "FromToMuchLoveOfLiving" # Delete after Test + # ----------------------------------------------------------------------------- + + DJANGO_TOKEN="aGFnZW4wMTM6emVhbG90MDk2" + + # ALLOWED HOSTS START + # ----------------------------------------------------------------------------- + ALLOWED_HOSTS = ["*"] + # ----------------------------------------------------------------------------- + + # APPS SETTINGS START + # ----------------------------------------------------------------------------- + # INSTALLED_APPS += [ + # "django_extensions", + # ] + # ----------------------------------------------------------------------------- + + # DEBUG SETTINGS START + # ----------------------------------------------------------------------------- + DEBUG = True + # ----------------------------------------------------------------------------- + + REVIEW_HOST='http://backend-service.flows.svc.cluster.local:8000' + # ----------------------------------------------------------------------------- + # EXTERNAL SERVICES END + + WORKFLOWS_HOST = "http://workflows-api-service.workflow.svc.cluster.local:8000" + WORKFLOWS_URL = "http://workflows-api-service.workflow.svc.cluster.local:8000" + DOCUMENTATIONS_URL = "http://documentations-api.documentations.svc.cluster.local:8080" + RESOURCES_API_HOST = os.getenv("RESOURCES_API_HOST", default="http://resources-service.resources.svc.cluster:8000") + KAFKA_HOST = "wb-prod-kafka-bootstrap.kafka.svc.cluster.local:9093" + KAFKA_USERNAME = "sarex" + KAFKA_PASSWORD = "nK36sasvSfoItJnXQ4qxav2OUWIPX5ZC" + KAFKA_SSL_CAFILE = os.getenv("KAFKA_SSL_CAFILE", "/usr/local/share/ca-certificates/kafka.crt") + KAFKA_EAV_ASSETS_TOPIC = os.getenv("KAFKA_EAV_ASSETS_TOPIC", "sarex") + KAFKA_ISSUES_TOPIC = os.getenv("KAFKA_ISSUES_TOPIC", "sarex-issues") + + + USE_ASYNC_FUNCTIONS = True + #USE_NOTIFICATIONS = False + + # JWT SETTINGS START + # --------------------------------------------------------------------------------------------------------------------- + SIMPLE_JWT_ISSUER = os.getenv("SIMPLE_JWT_ISSUER", default="default_issuer") + + SIMPLE_JWT = { + "ACCESS_TOKEN_LIFETIME": timedelta(minutes=5), + "REFRESH_TOKEN_LIFETIME": timedelta(days=1), + "ROTATE_REFRESH_TOKENS": False, + "UPDATE_LAST_LOGIN": False, + + "ALGORITHM": "RS512", + "SIGNING_KEY": os.getenv("JWT_PRIVATE_KEY", default="").replace("\\n", "\n"), + "VERIFYING_KEY": os.getenv("JWT_PUBLIC_KEY").replace("\\n", "\n"), + "AUDIENCE": None, + "ISSUER": SIMPLE_JWT_ISSUER, + + "AUTH_HEADER_TYPES": ("Bearer",), + "AUTH_HEADER_NAME": "HTTP_AUTHORIZATION", + "USER_ID_FIELD": "id", + "USER_ID_CLAIM": "user_id", + + "AUTH_TOKEN_CLASSES": ("rest_framework_simplejwt.tokens.AccessToken",), + "TOKEN_TYPE_CLAIM": "token_type", + + "JTI_CLAIM": "jti", + + "SLIDING_TOKEN_REFRESH_EXP_CLAIM": "refresh_exp", + "SLIDING_TOKEN_LIFETIME": timedelta(minutes=5), + "SLIDING_TOKEN_REFRESH_LIFETIME": timedelta(days=1), + } + # --------------------------------------------------------------------------------------------------------------------- + + CORS_ALLOWED_ORIGINS = [ + "https://lk.srx.wb.ru:30443", + ] + + CORS_TRUSTED_ORIGINS = [ + "https://lk.srx.wb.ru:30443", + ] + + CSRF_TRUSTED_ORIGINS = [ + "https://lk.srx.wb.ru:30443", + ] + + CORS_ALLOW_ALL_ORIGINS = True + ENABLE_MAILGUN=False + SMTP_PORT=465 + SMTP_HOST="mail.rwb.ru" + EMAIL_FROM="sarex@rwb.ru" + + CORS_ALLOW_METHODS = [ + "DELETE", + "GET", + "OPTIONS", + "PATCH", + "POST", + "PUT", + ] + + SAREX_API = "https://srx.wb.ru" + + AERO_PUBLIC_HOST = os.getenv("AERO_PUBLIC_HOST", default=SAREX_API) + + BASE_AERO_URL = "http://backend.django.svc.cluster.local:8000" + + ENVIRONMENT = "production" + + SESSION_COOKIE_NAME = "issues-sessionid" + CSRF_COOKIE_NAME = "issues-csrftoken" + STATIC_URL = "/static/" + STORAGES = { + 'default': { + 'BACKEND': "storages.backends.s3boto3.S3Boto3Storage", + }, + 'staticfiles': { + # Leave whatever setting you already have here, e.g.: + 'BACKEND': "storages.backends.s3boto3.S3Boto3Storage", + } + } diff --git a/apps/issues/wb/redis.yaml b/apps/issues/wb/redis.yaml new file mode 100644 index 0000000..3deb89e --- /dev/null +++ b/apps/issues/wb/redis.yaml @@ -0,0 +1,88 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: redis + namespace: issues + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + redis: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/redis:latest + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: redis + + replicaCount: + _default: 1 + + port: + _default: 6379 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: redis + + type: + _default: ClusterIP + + port: + _default: 6379 + + targetPort: + _default: 6379 + + portName: + _default: tcp + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/issues/wb/remarks-static.yaml b/apps/issues/wb/remarks-static.yaml new file mode 100644 index 0000000..48080b2 --- /dev/null +++ b/apps/issues/wb/remarks-static.yaml @@ -0,0 +1,90 @@ +--- +# remarks-static — компонент приложения remarks (apps/remarks), в wb +# развёрнут в ns issues, а не в своём собственном неймспейсе. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: remarks-static + namespace: issues + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + remarks-static: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/remarks-frontend:wb_002f8896 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: remarks-static + + replicaCount: + _default: 1 + + port: + _default: 8080 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: remarks-static + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 8080 + + portName: + _default: tcp + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/issues/wb/static.yaml b/apps/issues/wb/static.yaml new file mode 100644 index 0000000..98f3723 --- /dev/null +++ b/apps/issues/wb/static.yaml @@ -0,0 +1,88 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: static + namespace: issues + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + static: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/contour_issues-frontend:716a2b73 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: static + + replicaCount: + _default: 1 + + port: + _default: 80 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: static-service + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 80 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/issues/wb/uwsgi-configmap.yaml b/apps/issues/wb/uwsgi-configmap.yaml new file mode 100644 index 0000000..50b930f --- /dev/null +++ b/apps/issues/wb/uwsgi-configmap.yaml @@ -0,0 +1,23 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: uwsgi-configmap + namespace: issues +data: + uwsgi.ini: |- + [uwsgi] + plugins-dir = /usr/lib/uwsgi/plugins + + chdir = /src + module = config.wsgi:application + master = true + processes = 4 + http = 0.0.0.0:8000 + chmod-socket = 666 + vacuum = true + harakiri = 6000 + buffer-size = 32768 + + static-map = /static=/opt/src/static/ + static-map = /media=/opt/src/media/ diff --git a/apps/message-hub/wb/kafka-cert-configmap.yaml b/apps/message-hub/wb/kafka-cert-configmap.yaml new file mode 100644 index 0000000..f1d8aab --- /dev/null +++ b/apps/message-hub/wb/kafka-cert-configmap.yaml @@ -0,0 +1,38 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: kafka-cert + namespace: message-hub +data: + kafka.crt: | + -----BEGIN CERTIFICATE----- + MIIFLTCCAxWgAwIBAgIUYDZPxGRsr7IiqHEmfd07QTQlOKYwDQYJKoZIhvcNAQEN + BQAwLTETMBEGA1UECgwKaW8uc3RyaW16aTEWMBQGA1UEAwwNY2x1c3Rlci1jYSB2 + MDAeFw0yNTEyMTYxNDM0NTVaFw0yNjEyMTYxNDM0NTVaMC0xEzARBgNVBAoMCmlv + LnN0cmltemkxFjAUBgNVBAMMDWNsdXN0ZXItY2EgdjAwggIiMA0GCSqGSIb3DQEB + AQUAA4ICDwAwggIKAoICAQCfzDZhEzw2pbU5Xpu8OzD+3iQG+DVjU8PQWWQEF27h + yjohDkUr3zCZtW7xMKWKUNxBgrKsfe4TDOQN8cij3cS9sy0So+UhMeF7Bq9PU1Yd + bmTRq8q1PiuNUkiCGJ5wrb3+NZvVxZLJUIFgiealsRw80MgMWWSzy0I35T2Edn/a + DU4jhlgQxyzQ621+oGP0n28gCjmm6pCq2tkj/Z8WTdu1gOWyRdK02a2uE2Ts2nLa + Di32GaZrIbIuD/WUd6Ek66uCeJvh2CT7s+SqgtMbtT7gibUuPQ3hk1VGQsjy22l3 + hUNpLu86nrwbuf21mY55KnLOcaVq1ag1TpIIKfZAL/KWFCGZ6H6kwEIbCAL0Hei7 + cJ2Wm2/qlzKUeU869M7YybZAfXl/t6XT4QgFgje+42N980vy5A4GhWi1Z7lPqqOe + jPGBstkRZybKz1sTk87+oJx82iQU/ozVmzjSEK1SoYRNbvug8PNpxmPoPnJ2flgG + t2q2+2ZQP3f1aAHVcZ3U5+hWlRmKPXzjrJv7gnhuvqJl7OwB50y+yWiVfZ9xrYl2 + EpX+yHuFFK+9NnB5taUK8Fz+hQaLU8J4q7P0bRqkoI+LdcEErjuDT/eI2d5+Ql8K + /JkV823hX2WNB9bdaQ24BelVUbsxGpR7ms6KWrM11kHnbzUlEM+AxZES6F7Qbr55 + TwIDAQABo0UwQzAdBgNVHQ4EFgQUM7hshx7e9TFEN82Pf446aBrJUA4wEgYDVR0T + AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQENBQADggIB + AFNHFGPDxY966fz0dxDFFSfeo47y7XQZMK9xAwH73cQoSeqx+IMxzgM8nfJQ9XMN + PeLwVRZ7pvRee2ZhUPglBSTHnW2rvfmLBOO9xyKZxRsCkoFxuHH9xfM7bFWb96R6 + fGrOdEZDB3yj00T+tkubwqt+/dUhQUj8juwyPs55WMb/0BIbapaoQ6QOP13CaXDV + ZmAfsEEIBkNxfq7GTr/z0Rq0B4+9FxAf3Jrsmi/dYoFD/prHsvBDkYw1daoFyp5C + tbctvB9wtphnCCynekt8UBvpVKHUU/xaUa09TQTToXjBbV1SZeIOHNG0MNbWa4sz + AL/cpXdq1EAxiTeAVT9XhCwhe/xJvFZIWuFLmW3J+ZxrOUCKieCYpTqBY2tBkkDY + //egic787yTR6zxqQNSzvNU5LhzrN7lu+KHGM06T35+HvpzgPPiRCzsxO62p63op + mq04K31yYZgLiqeAj5W+rioRGJNn4TXJpH9KIrzmGM7lVWLYWMAKeZU4r1lDUdcu + 7jsBH8BRJWJeVK3xVw2HB3lk7Xn0WrR92adeYQ3f0vKbMIAVUnSJ3yCKJ4NMFSki + j78nx2mi/G0RhUPGZ9hhLXQKj9BtbpEnwpbGWtf0ShtVOxD/HKLCr7koBtW9TMPS + 9K0sJhE5VjsQLkDDu9p3GdRcuLNA/oa7xFvRFtqGFsLj + -----END CERTIFICATE----- diff --git a/apps/message-hub/wb/kustomization.yaml b/apps/message-hub/wb/kustomization.yaml index a397afc..2ac5608 100644 --- a/apps/message-hub/wb/kustomization.yaml +++ b/apps/message-hub/wb/kustomization.yaml @@ -3,4 +3,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: message-hub resources: - - ../base + - kafka-cert-configmap.yaml + - message-hub.yaml diff --git a/apps/message-hub/wb/message-hub.yaml b/apps/message-hub/wb/message-hub.yaml new file mode 100644 index 0000000..ccba504 --- /dev/null +++ b/apps/message-hub/wb/message-hub.yaml @@ -0,0 +1,209 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: message-hub + namespace: message-hub + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + message-hub: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/message-hub:production_24425472 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: message-hub-message-hub + + replicaCount: + _default: 1 + + port: + _default: 8000 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: message-hub-message-hub + + type: + _default: ClusterIP + + port: + _default: 8000 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + volumes: + _default: + - name: kafka-cert-volume + mountPath: + _default: /usr/local/share/ca-certificates + readOnly: + _default: true + configMap: + name: + _default: kafka-cert + + envs: + - name: WORKER_TIMEOUT + value: + _default: "60" + + - name: PYTHONPATH + value: + _default: "src" + + - name: SETTINGS_MAX_RETRIES + value: + _default: "1" + + - name: SETTINGS_TOPICS + value: + _default: '{"planning": "pm", "assets": "assets_broadcast", "project_entity": "issues_broadcast"}' + + - name: SETTINGS_PDF_CONVERTER_HOST + value: + _default: "http://export-project-service.django.svc.cluster.local:8000" + + - name: SAREX_BASE_HOST + value: + _default: "http://backend-service.pm.svc.cluster.local:8000" + + - name: DB_HOST + value: + _default: "sarex-vpsql-01.xc.wb.ru" + + - name: DB_PORT + value: + _default: "5432" + + - name: DB_DATABASE + value: + _default: "pm_db" + + - name: CACHE_HOST + value: + _default: "redis.pm.svc.cluster.local" + + - name: CACHE_PORT + value: + _default: "6379" + + - name: CACHE_SSL + value: + _default: "0" + + - name: KAFKA_HOST + value: + _default: "wb-prod-kafka-bootstrap.kafka.svc.cluster.local" + + - name: KAFKA_PORT + value: + _default: "9093" + + - name: KAFKA_SECURITY_PROTOCOL + value: + _default: "SSL" + + - name: KAFKA_SASL_MECHANISM + value: + _default: "SCRAM-SHA-512" + + - name: KAFKA_SSL_CAFILE + value: + _default: "/usr/local/share/ca-certificates/kafka.crt" + + secretEnvs: + - name: KAFKA_USERNAME + secretName: + _default: "kafka-secret" + secretKey: "username" + + - name: KAFKA_PASSWORD + secretName: + _default: "kafka-secret" + secretKey: "password" + + - name: DB_USERNAME + secretName: + _default: "postgres-pm-secret" + secretKey: "username" + + - name: DB_PASSWORD + secretName: + _default: "postgres-pm-secret" + secretKey: "password" + + - name: S3_LOGIN + secretName: + _default: "s3-secret" + secretKey: "username" + + - name: S3_PASSWORD + secretName: + _default: "s3-secret" + secretKey: "password" + + - name: S3_BUCKET + secretName: + _default: "s3-secret" + secretKey: "bucket" + + - name: S3_HOST + secretName: + _default: "s3-secret" + secretKey: "host" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/pm/wb/backend-configmap.yaml b/apps/pm/wb/backend-configmap.yaml new file mode 100644 index 0000000..613257c --- /dev/null +++ b/apps/pm/wb/backend-configmap.yaml @@ -0,0 +1,30 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: backend-configmap + namespace: pm +data: + uwsgi.ini: | + [uwsgi] + log-format = {"time": "%(time)", "method": "%(method)", "uri": "%(uri)", "status": "%(status)", "size": "%(size)", "addr": "%(addr)", "user": "%(user)", "proto": "%(proto)", "user_agent": "%(uagent)", "referer": "%(referer)", "trace_id": "%(trace_id)", "span_id": "%(span_id)"} + module = config.wsgi:application + DJANGO_SETTINGS_MODULE = config.settings.base + http = 0.0.0.0:8000 + processes = 8 + master = true + vacuum = true + enable-threads = true + buffer-size = 65535 + stats = :3031 + stats-http = true + memory-report = true + lazy-apps = true + listen = 1024 + disable-write-exception= 0 + harakiri = 300 + socket-timeout = 300 + chunked-input-timeout = 300 + http-timeout = 300 + worker-reload-mercy = 240 + mule-reload-mercy = 240 diff --git a/apps/pm/wb/backend.yaml b/apps/pm/wb/backend.yaml new file mode 100644 index 0000000..30ca81a --- /dev/null +++ b/apps/pm/wb/backend.yaml @@ -0,0 +1,153 @@ +--- +# ENV-файл env-file (secret sarex-env, ключ .env) содержит остальные секреты +# приложения (DB/S3/Kafka и т.п.) — в дампе кластера Secret'ы не выгружены, +# сам файл-секрет должен уже существовать в неймспейсе pm. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: backend + namespace: pm + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + backend: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/pm-backend:production_c54c2123 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: backend + + replicaCount: + _default: 1 + + port: + _default: 8000 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: backend-service + + type: + _default: ClusterIP + + port: + _default: 8000 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + volumes: + _default: + - name: uwsgi-configmap + mountPath: + _default: /opt/sarex/uwsgi.ini + subPath: + _default: uwsgi.ini + readOnly: + _default: true + configMap: + name: + _default: backend-configmap + items: + - key: uwsgi.ini + path: + _default: uwsgi.ini + + - name: env-file + mountPath: + _default: /opt/sarex/.env + subPath: + _default: .env + readOnly: + _default: true + secret: + secretName: + _default: sarex-env + items: + - key: .env + path: + _default: .env + + - name: kafka-cert-volume + mountPath: + _default: /usr/local/share/ca-certificates + readOnly: + _default: true + configMap: + name: + _default: kafka-cert + + envs: + - name: USERS_INTERNAL_HOST + value: + _default: "http://backend.django.svc.cluster.local:8000" + + - name: RESOURCES_INTERNAL_HOST + value: + _default: "http://resources-service.resources.svc.cluster.local:8000" + + - name: EAV_HOST + value: + _default: "http://eav-service.eav.svc.cluster.local:8000" + + - name: EAV_API_PREFIX + value: + _default: "/api/v0" + + - name: EAV_API_PREFIX_V1 + value: + _default: "/api/v1" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/pm/wb/celery.yaml b/apps/pm/wb/celery.yaml new file mode 100644 index 0000000..1d56d02 --- /dev/null +++ b/apps/pm/wb/celery.yaml @@ -0,0 +1,146 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: celery + namespace: pm + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + celery: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/pm-backend:production_c54c2123 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: celery + + replicaCount: + _default: 1 + + port: + _default: 8000 + + command: + _default: ["celery", "-A", "config", "worker", "-B", "-l", "info", "-E", "-Q", "pm", "-n", "default_worker.%h", "--concurrency=2"] + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + volumes: + _default: + - name: uwsgi-configmap + mountPath: + _default: /opt/sarex/uwsgi.ini + subPath: + _default: uwsgi.ini + readOnly: + _default: true + configMap: + name: + _default: backend-configmap + items: + - key: uwsgi.ini + path: + _default: uwsgi.ini + + - name: env-file + mountPath: + _default: /opt/sarex/.env + subPath: + _default: .env + readOnly: + _default: true + secret: + secretName: + _default: sarex-env + items: + - key: .env + path: + _default: .env + + - name: kafka-cert-volume + mountPath: + _default: /usr/local/share/ca-certificates + readOnly: + _default: true + configMap: + name: + _default: kafka-cert + + envs: + - name: PLANNING_HOST + value: + _default: "http://backend-service.pm.svc.cluster.local:8000/api/pm/msp" + + - name: PLANNING_USE + value: + _default: "True" + + - name: USERS_INTERNAL_HOST + value: + _default: "http://backend.django.svc.cluster.local:8000" + + - name: RESOURCES_INTERNAL_HOST + value: + _default: "http://resources-service.resources.svc.cluster.local:8000" + + - name: EAV_HOST + value: + _default: "http://eav-service.eav.svc.cluster.local:8000" + + - name: EAV_API_PREFIX + value: + _default: "/api/v0" + + - name: EAV_API_PREFIX_V1 + value: + _default: "/api/v1" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/pm/wb/kafka-cert-configmap.yaml b/apps/pm/wb/kafka-cert-configmap.yaml new file mode 100644 index 0000000..c742356 --- /dev/null +++ b/apps/pm/wb/kafka-cert-configmap.yaml @@ -0,0 +1,38 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: kafka-cert + namespace: pm +data: + kafka.crt: | + -----BEGIN CERTIFICATE----- + MIIFLTCCAxWgAwIBAgIUYDZPxGRsr7IiqHEmfd07QTQlOKYwDQYJKoZIhvcNAQEN + BQAwLTETMBEGA1UECgwKaW8uc3RyaW16aTEWMBQGA1UEAwwNY2x1c3Rlci1jYSB2 + MDAeFw0yNTEyMTYxNDM0NTVaFw0yNjEyMTYxNDM0NTVaMC0xEzARBgNVBAoMCmlv + LnN0cmltemkxFjAUBgNVBAMMDWNsdXN0ZXItY2EgdjAwggIiMA0GCSqGSIb3DQEB + AQUAA4ICDwAwggIKAoICAQCfzDZhEzw2pbU5Xpu8OzD+3iQG+DVjU8PQWWQEF27h + yjohDkUr3zCZtW7xMKWKUNxBgrKsfe4TDOQN8cij3cS9sy0So+UhMeF7Bq9PU1Yd + bmTRq8q1PiuNUkiCGJ5wrb3+NZvVxZLJUIFgiealsRw80MgMWWSzy0I35T2Edn/a + DU4jhlgQxyzQ621+oGP0n28gCjmm6pCq2tkj/Z8WTdu1gOWyRdK02a2uE2Ts2nLa + Di32GaZrIbIuD/WUd6Ek66uCeJvh2CT7s+SqgtMbtT7gibUuPQ3hk1VGQsjy22l3 + hUNpLu86nrwbuf21mY55KnLOcaVq1ag1TpIIKfZAL/KWFCGZ6H6kwEIbCAL0Hei7 + cJ2Wm2/qlzKUeU869M7YybZAfXl/t6XT4QgFgje+42N980vy5A4GhWi1Z7lPqqOe + jPGBstkRZybKz1sTk87+oJx82iQU/ozVmzjSEK1SoYRNbvug8PNpxmPoPnJ2flgG + t2q2+2ZQP3f1aAHVcZ3U5+hWlRmKPXzjrJv7gnhuvqJl7OwB50y+yWiVfZ9xrYl2 + EpX+yHuFFK+9NnB5taUK8Fz+hQaLU8J4q7P0bRqkoI+LdcEErjuDT/eI2d5+Ql8K + /JkV823hX2WNB9bdaQ24BelVUbsxGpR7ms6KWrM11kHnbzUlEM+AxZES6F7Qbr55 + TwIDAQABo0UwQzAdBgNVHQ4EFgQUM7hshx7e9TFEN82Pf446aBrJUA4wEgYDVR0T + AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQENBQADggIB + AFNHFGPDxY966fz0dxDFFSfeo47y7XQZMK9xAwH73cQoSeqx+IMxzgM8nfJQ9XMN + PeLwVRZ7pvRee2ZhUPglBSTHnW2rvfmLBOO9xyKZxRsCkoFxuHH9xfM7bFWb96R6 + fGrOdEZDB3yj00T+tkubwqt+/dUhQUj8juwyPs55WMb/0BIbapaoQ6QOP13CaXDV + ZmAfsEEIBkNxfq7GTr/z0Rq0B4+9FxAf3Jrsmi/dYoFD/prHsvBDkYw1daoFyp5C + tbctvB9wtphnCCynekt8UBvpVKHUU/xaUa09TQTToXjBbV1SZeIOHNG0MNbWa4sz + AL/cpXdq1EAxiTeAVT9XhCwhe/xJvFZIWuFLmW3J+ZxrOUCKieCYpTqBY2tBkkDY + //egic787yTR6zxqQNSzvNU5LhzrN7lu+KHGM06T35+HvpzgPPiRCzsxO62p63op + mq04K31yYZgLiqeAj5W+rioRGJNn4TXJpH9KIrzmGM7lVWLYWMAKeZU4r1lDUdcu + 7jsBH8BRJWJeVK3xVw2HB3lk7Xn0WrR92adeYQ3f0vKbMIAVUnSJ3yCKJ4NMFSki + j78nx2mi/G0RhUPGZ9hhLXQKj9BtbpEnwpbGWtf0ShtVOxD/HKLCr7koBtW9TMPS + 9K0sJhE5VjsQLkDDu9p3GdRcuLNA/oa7xFvRFtqGFsLj + -----END CERTIFICATE----- diff --git a/apps/pm/wb/kustomization.yaml b/apps/pm/wb/kustomization.yaml index ae44f4c..6e22f32 100644 --- a/apps/pm/wb/kustomization.yaml +++ b/apps/pm/wb/kustomization.yaml @@ -3,4 +3,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: pm resources: - - ../base + - backend-configmap.yaml + - kafka-cert-configmap.yaml + - backend.yaml + - celery.yaml + - redis.yaml diff --git a/apps/pm/wb/redis.yaml b/apps/pm/wb/redis.yaml new file mode 100644 index 0000000..e2ad4eb --- /dev/null +++ b/apps/pm/wb/redis.yaml @@ -0,0 +1,88 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: redis + namespace: pm + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + redis: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/redis:latest + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: redis + + replicaCount: + _default: 1 + + port: + _default: 6379 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: redis + + type: + _default: ClusterIP + + port: + _default: 6379 + + targetPort: + _default: 6379 + + portName: + _default: tcp + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/processing/wb/engine-low.yaml b/apps/processing/wb/engine-low.yaml new file mode 100644 index 0000000..d0b8fff --- /dev/null +++ b/apps/processing/wb/engine-low.yaml @@ -0,0 +1,434 @@ +--- +# serviceAccountName в дампе: workflows-backend-sa (нужен для +# ENABLE_KUBERNETES_EXECUTOR=1). Role/RoleBinding под этот SA в дампе не было, +# их нужно завести отдельно, если ещё не существуют в неймспейсе workflow. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: engine-low + namespace: workflow + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + engine-low: + enabled: true + + serviceAccount: + enabled: + _default: false + name: + _default: workflows-backend-sa + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/workflows-engine:prod_b6e15fda + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: engine-low + + replicaCount: + _default: 1 + + port: + _default: 8080 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + volumes: + _default: + - name: yc-s3 + mountPath: + _default: /etc/sarex/yc-s3 + readOnly: + _default: true + secret: + secretName: + _default: yc-s3 + + - name: django-auth + mountPath: + _default: /etc/django-auth + readOnly: + _default: true + secret: + secretName: + _default: django-auth + + - name: smtp-secret + mountPath: + _default: /etc/smtp-secret + readOnly: + _default: true + secret: + secretName: + _default: smtp-secret + + envs: + - name: RABBITMQ_HOST + value: + _default: "rabbitmq-service.workflow.svc.cluster.local" + + - name: RABBITMQ_PORT + value: + _default: "5672/api" + + - name: POSTGRES_ADDRESS + value: + _default: "sarex-vpsql-01.xc.wb.ru" + + - name: POSTGRES_PORT + value: + _default: "5432" + + - name: POSTGRES_POOL_SIZE + value: + _default: "20" + + - name: ENVIRONMENT + value: + _default: "prod" + + - name: WORKFLOWS_SENTRY_DSN + value: + _default: "https://866b532efdbb4764a7551b76231232fc@o279218.ingest.sentry.io/543123" + + - name: WORKFLOWS_SENTRY_DEBUG + value: + _default: "0" + + - name: API_ADDRESS + value: + _default: "0.0.0.0:8000" + + - name: DJANGO_HOST + value: + _default: "http://backend.django.svc.cluster.local:8000" + + - name: S3_SERVICE_ACCOUNT + value: + _default: "/etc/sarex/yc-s3/yc-s3-service-account.json" + + - name: BIM_API_V2_DB + value: + _default: "/etc/sarex/bim-api-v2-db-prod.json" + + - name: PDM_API_DB + value: + _default: "/etc/pdm/pdm-api-db-prod.json" + + - name: WORKSPACE_API_DB + value: + _default: "/etc/ws/ws-api-db-prod.json" + + - name: ISSUE_API_DB + value: + _default: "/etc/issues/issue-api-db-prod.json" + + - name: MAILGUN + value: + _default: "/etc/mailgun-secret/env.json" + + - name: SMTP + value: + _default: "/etc/smtp-secret/smtp.json" + + - name: INTERNAL_PDM_URL + value: + _default: "http://documentations-api.documentations.svc.cluster.local:8080" + + - name: INTERNAL_FILESTREAM_URL + value: + _default: "http://documentations-filestream.documentations.svc.cluster.local:8080" + + - name: EXTERNAL_PDM_URL + value: + _default: "http://documentations-api.documentations.svc.cluster.local:8080" + + - name: EXTERNAL_FILESTREAM_URL + value: + _default: "http://documentations-filestream-service.documentations.svc.cluster.local:8080" + + - name: RESOURCES_API_INTERNAL_HOST + value: + _default: "http://resources-service.resources.svc.cluster.local:8000" + + - name: ENABLE_SQL_QUERY + value: + _default: "0" + + - name: ENABLE_S3_STORAGE + value: + _default: "1" + + - name: ENABLE_S3V2_STORAGE + value: + _default: "1" + + - name: ENABLE_PDM_STORAGE + value: + _default: "1" + + - name: ENABLE_SMTP + value: + _default: "1" + + - name: ENABLE_URL_STORAGE + value: + _default: "1" + + - name: ENABLE_SRX_TMP + value: + _default: "1" + + - name: ENABLE_BIM_API_V2_DB + value: + _default: "1" + + - name: ENABLE_WORKSPACE_API_DB + value: + _default: "1" + + - name: ENABLE_ISSUE_API_DB + value: + _default: "1" + + - name: ENABLE_RESOURCES_API + value: + _default: "1" + + - name: ENABLE_PDM_API_DB + value: + _default: "1" + + - name: ENABLE_COMPARISONS_API_DB + value: + _default: "1" + + - name: ENABLE_MAIL_GUN + value: + _default: "1" + + - name: ENABLE_AMQP_EXECUTOR + value: + _default: "0" + + - name: ENABLE_KUBERNETES_EXECUTOR + value: + _default: "1" + + - name: MAX_WORKFLOWS_LIMIT + value: + _default: "5" + + - name: CPU_COUNT + value: + _default: "1" + + - name: MEMORY_GI + value: + _default: "1" + + - name: CPU_COUNT_LOW_RESOURCES + value: + _default: "1" + + - name: MEMORY_GI_LOW_RESOURCES + value: + _default: "1" + + - name: CPU_COUNT_HIGH_MEM + value: + _default: "1" + + - name: MEMORY_GI_HIGH_MEM + value: + _default: "1" + + - name: ENABLE_TOLERATION + value: + _default: "1" + + - name: COUNT_RUNNING_WORKERS + value: + _default: "1" + + - name: COUNT_CANCELING_WORKERS + value: + _default: "1" + + - name: COUNT_HANDLE_JOB_WORKERS + value: + _default: "1" + + - name: BIM_API_DEBUG + value: + _default: "0" + + - name: BIM_API_V2_DEBUG + value: + _default: "0" + + - name: PDM_API_DEBUG + value: + _default: "0" + + - name: COMPARISONS_API_DEBUG + value: + _default: "0" + + - name: WORKSPACE_API_DEBUG + value: + _default: "0" + + - name: JOBS_NAMESPACE + value: + _default: "workflow" + + - name: ISSUE_API_DEBUG + value: + _default: "0" + + - name: TOLERATION_KEY + value: + _default: "dedicated" + + - name: TOLERATION_VALUE + value: + _default: "processing-light" + + - name: TOLERATION_KEY_HIGH_MEM + value: + _default: "dedicated" + + - name: TOLERATION_VALUE_HIGH_MEM + value: + _default: "processing-light" + + - name: TOLERATION_KEY_PERSISTENT + value: + _default: "dedicated" + + - name: TOLERATION_VALUE_PERSISTENT + value: + _default: "processing-light" + + - name: RABBITMQ_CREATE_EXCHANGE + value: + _default: "autodesk.inputMessage" + + - name: RABBITMQ_CANCEL_EXCHANGE + value: + _default: "autodesk.cancelMessage" + + - name: RABBITMQ_CREATE_ROUTING_KEY + value: + _default: "converting" + + - name: RABBITMQ_CANCEL_TOPIC + value: + _default: "cancel" + + - name: RABBITMQ_COMPLETENESS_EXCHANGE + value: + _default: "autodesk.outputMessage" + + - name: RABBITMQ_COMPLETENESS_TOPIC + value: + _default: "output_navis" + + - name: CONTROL_PLANE_PERIOD + value: + _default: "10s" + + - name: WORKFLOW_PRIORITY + value: + _default: "low" + + - name: DEFAULT_TOLERATION_KEY + value: + _default: "dedicated" + + - name: DEFAULT_TOLERATION_VALUE + value: + _default: "processing-light" + + - name: DEFAULT_NODE_SELECTOR_KEY + value: + _default: "dedicated" + + - name: DEFAULT_NODE_SELECTOR_VALUE + value: + _default: "processing-light" + + secretEnvs: + - name: RABBITMQ_USER + secretName: + _default: "rabbitmq-secret" + secretKey: "username" + + - name: RABBITMQ_PASS + secretName: + _default: "rabbitmq-secret" + secretKey: "password" + + - name: POSTGRES_USER + secretName: + _default: "postgres-secret" + secretKey: "username" + + - name: POSTGRES_PASSWORD + secretName: + _default: "postgres-secret" + secretKey: "password" + + - name: POSTGRES_DB + secretName: + _default: "postgres-secret" + secretKey: "database" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/processing/wb/engine.yaml b/apps/processing/wb/engine.yaml new file mode 100644 index 0000000..7a3572d --- /dev/null +++ b/apps/processing/wb/engine.yaml @@ -0,0 +1,427 @@ +--- +# serviceAccountName в дампе: workflows-backend-sa (нужен для +# ENABLE_KUBERNETES_EXECUTOR=1 — engine создаёт Job'ы). Role/RoleBinding под +# этот SA в дампе не было (экспортировались только deployments/services/configmaps), +# их нужно завести отдельно, если ещё не существуют в неймспейсе workflow. +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: engine + namespace: workflow + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + engine: + enabled: true + + serviceAccount: + enabled: + _default: false + name: + _default: workflows-backend-sa + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/workflows-engine:prod_b6e15fda + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: engine + + replicaCount: + _default: 1 + + port: + _default: 8080 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + volumes: + _default: + - name: yc-s3 + mountPath: + _default: /etc/sarex/yc-s3 + readOnly: + _default: true + secret: + secretName: + _default: yc-s3 + + - name: django-auth + mountPath: + _default: /etc/django-auth + readOnly: + _default: true + secret: + secretName: + _default: django-auth + + - name: smtp-secret + mountPath: + _default: /etc/smtp-secret + readOnly: + _default: true + secret: + secretName: + _default: smtp-secret + + envs: + - name: TOLERATION_KEY + value: + _default: "dedicated" + + - name: DEFAULT_TOLERATION_KEY + value: + _default: "dedicated" + + - name: DEFAULT_TOLERATION_VALUE + value: + _default: "processing-light" + + - name: TOLERATION_VALUE + value: + _default: "processing-light" + + - name: TOLERATION_KEY_HIGH_MEM + value: + _default: "dedicated" + + - name: TOLERATION_VALUE_HIGH_MEM + value: + _default: "processing-light" + + - name: TOLERATION_KEY_PERSISTENT + value: + _default: "dedicated" + + - name: TOLERATION_VALUE_PERSISTENT + value: + _default: "processing-light" + + - name: RABBITMQ_HOST + value: + _default: "rabbitmq.rabbitmq.svc.cluster.local" + + - name: RABBITMQ_PORT + value: + _default: "5672/cad" + + - name: POSTGRES_ADDRESS + value: + _default: "sarex-vpsql-01.xc.wb.ru" + + - name: POSTGRES_PORT + value: + _default: "5432" + + - name: WORKFLOWS_SENTRY_DSN + value: + _default: "https://866b532efdbb4764a7551b76231232fc@o279218.ingest.sentry.io/543123" + + - name: WORKFLOWS_SENTRY_DEBUG + value: + _default: "0" + + - name: POSTGRES_POOL_SIZE + value: + _default: "20" + + - name: ENABLE_SMTP + value: + _default: "1" + + - name: SMTP + value: + _default: "/etc/smtp-secret/smtp.json" + + - name: ENVIRONMENT + value: + _default: "prod" + + - name: API_ADDRESS + value: + _default: "0.0.0.0:8000" + + - name: DJANGO_HOST + value: + _default: "http://backend.django.svc.cluster.local:8000" + + - name: S3_SERVICE_ACCOUNT + value: + _default: "/etc/sarex/yc-s3/yc-s3-service-account.json" + + - name: BIM_API_V2_DB + value: + _default: "/etc/sarex/bim-api-v2-db-prod.json" + + - name: PDM_API_DB + value: + _default: "/etc/pdm/pdm-api-db-prod.json" + + - name: WORKSPACE_API_DB + value: + _default: "/etc/ws/ws-api-db-prod.json" + + - name: ISSUE_API_DB + value: + _default: "/etc/issues/issue-api-db-prod.json" + + - name: MAILGUN + value: + _default: "/etc/mailgun-secret/env.json" + + - name: INTERNAL_PDM_URL + value: + _default: "http://documentations-api.documentations.svc.cluster.local:8080" + + - name: INTERNAL_FILESTREAM_URL + value: + _default: "http://documentations-filestream.documentations.svc.cluster.local:8080" + + - name: EXTERNAL_PDM_URL + value: + _default: "http://documentations-api.documentations.svc.cluster.local:8080" + + - name: EXTERNAL_FILESTREAM_URL + value: + _default: "http://documentations-filestream-service.documentations.svc.cluster.local:8080" + + - name: RESOURCES_API_INTERNAL_HOST + value: + _default: "http://resources-service.resources.svc.cluster.local:8000" + + - name: ENABLE_SQL_QUERY + value: + _default: "0" + + - name: ENABLE_S3_STORAGE + value: + _default: "1" + + - name: ENABLE_S3V2_STORAGE + value: + _default: "1" + + - name: ENABLE_PDM_STORAGE + value: + _default: "1" + + - name: ENABLE_URL_STORAGE + value: + _default: "1" + + - name: ENABLE_SRX_TMP + value: + _default: "1" + + - name: ENABLE_BIM_API_V2_DB + value: + _default: "1" + + - name: ENABLE_WORKSPACE_API_DB + value: + _default: "1" + + - name: ENABLE_ISSUE_API_DB + value: + _default: "1" + + - name: ENABLE_RESOURCES_API + value: + _default: "1" + + - name: ENABLE_PDM_API_DB + value: + _default: "1" + + - name: ENABLE_COMPARISONS_API_DB + value: + _default: "1" + + - name: ENABLE_MAIL_GUN + value: + _default: "0" + + - name: ENABLE_AMQP_EXECUTOR + value: + _default: "1" + + - name: ENABLE_KUBERNETES_EXECUTOR + value: + _default: "1" + + - name: MAX_WORKFLOWS_LIMIT + value: + _default: "5" + + - name: CPU_COUNT + value: + _default: "1" + + - name: MEMORY_GI + value: + _default: "1" + + - name: CPU_COUNT_LOW_RESOURCES + value: + _default: "1" + + - name: MEMORY_GI_LOW_RESOURCES + value: + _default: "1" + + - name: CPU_COUNT_HIGH_MEM + value: + _default: "1" + + - name: MEMORY_GI_HIGH_MEM + value: + _default: "1" + + - name: ENABLE_TOLERATION + value: + _default: "1" + + - name: COUNT_RUNNING_WORKERS + value: + _default: "1" + + - name: COUNT_CANCELING_WORKERS + value: + _default: "1" + + - name: COUNT_HANDLE_JOB_WORKERS + value: + _default: "1" + + - name: BIM_API_DEBUG + value: + _default: "0" + + - name: BIM_API_V2_DEBUG + value: + _default: "0" + + - name: PDM_API_DEBUG + value: + _default: "0" + + - name: COMPARISONS_API_DEBUG + value: + _default: "0" + + - name: WORKSPACE_API_DEBUG + value: + _default: "0" + + - name: JOBS_NAMESPACE + value: + _default: "workflow" + + - name: ISSUE_API_DEBUG + value: + _default: "0" + + - name: RABBITMQ_CREATE_EXCHANGE + value: + _default: "autodesk.inputMessage" + + - name: RABBITMQ_CANCEL_EXCHANGE + value: + _default: "autodesk.cancelMessage" + + - name: RABBITMQ_CREATE_ROUTING_KEY + value: + _default: "converting" + + - name: RABBITMQ_CANCEL_TOPIC + value: + _default: "cancel" + + - name: RABBITMQ_COMPLETENESS_EXCHANGE + value: + _default: "autodesk.outputMessage" + + - name: RABBITMQ_COMPLETENESS_TOPIC + value: + _default: "output" + + - name: CONTROL_PLANE_PERIOD + value: + _default: "10s" + + - name: WORKFLOW_PRIORITY + value: + _default: "high" + + secretEnvs: + - name: RABBITMQ_USER + secretName: + _default: "rabbitmq-secret" + secretKey: "username" + + - name: RABBITMQ_PASS + secretName: + _default: "rabbitmq-secret" + secretKey: "password" + + - name: POSTGRES_USER + secretName: + _default: "postgres-secret" + secretKey: "username" + + - name: POSTGRES_PASSWORD + secretName: + _default: "postgres-secret" + secretKey: "password" + + - name: POSTGRES_DB + secretName: + _default: "postgres-secret" + secretKey: "database" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/processing/wb/frontend.yaml b/apps/processing/wb/frontend.yaml new file mode 100644 index 0000000..65a4aec --- /dev/null +++ b/apps/processing/wb/frontend.yaml @@ -0,0 +1,88 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: frontend + namespace: workflow + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + frontend: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/workflows-frontend:wb_ebc15427 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: frontend + + replicaCount: + _default: 1 + + port: + _default: 8080 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: frontend-service + + type: + _default: ClusterIP + + port: + _default: 8080 + + targetPort: + _default: 8080 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/processing/wb/kustomization.yaml b/apps/processing/wb/kustomization.yaml index 744e521..45e1c94 100644 --- a/apps/processing/wb/kustomization.yaml +++ b/apps/processing/wb/kustomization.yaml @@ -1,13 +1,10 @@ --- -# В wb приложение processing разворачивается в неймспейс workflow (не -# processing, как в base/ugmk). +# processing разворачивается в wb в неймспейс workflow (не processing). apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: workflow resources: - - ../base -patches: - - path: rbac.yaml - target: - kind: RoleBinding - name: processing-jobs + - engine.yaml + - engine-low.yaml + - frontend.yaml + - workflows-api.yaml diff --git a/apps/processing/wb/rbac.yaml b/apps/processing/wb/rbac.yaml deleted file mode 100644 index 5624315..0000000 --- a/apps/processing/wb/rbac.yaml +++ /dev/null @@ -1,19 +0,0 @@ ---- -# kustomize сам переименовывает Namespace/Role/RoleBinding в workflow через -# поле namespace: в kustomization.yaml, но НЕ подставляет новый неймспейс в -# subjects[].namespace у RoleBinding (это не namespaced-поле верхнего уровня) — -# поэтому ServiceAccount-субъект приходится поправить руками, иначе биндинг -# будет ссылаться на несуществующий processing-vault в ns processing. -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: processing-jobs - namespace: processing -subjects: - - kind: ServiceAccount - name: processing-vault - namespace: workflow -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: processing-jobs diff --git a/apps/processing/wb/workflows-api.yaml b/apps/processing/wb/workflows-api.yaml new file mode 100644 index 0000000..7be22ad --- /dev/null +++ b/apps/processing/wb/workflows-api.yaml @@ -0,0 +1,142 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: workflows-api + namespace: workflow + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + workflows-api: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/workflows-api:prod_e963403f + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: workflows-api + + replicaCount: + _default: 1 + + port: + _default: 8080 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: workflows-api-service + + type: + _default: ClusterIP + + port: + _default: 8000 + + targetPort: + _default: 8080 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + envs: + - name: POSTGRES_ADDRESS + value: + _default: "sarex-vpsql-01.xc.wb.ru" + + - name: POSTGRES_PORT + value: + _default: "5432" + + - name: POSTGRES_POOL_SIZE + value: + _default: "3" + + - name: HTTP_HOST + value: + _default: "0.0.0.0:8080" + + - name: DJANGO_HOST + value: + _default: "http://backend.django.svc.cluster.local:8000" + + - name: S3_SERVICE_ACCOUNT + value: + _default: "/etc/sarex/yc-s3/yc-s3-service-account.json" + + - name: ENABLE_SQL_QUERY + value: + _default: "0" + + - name: POSTGRES_SSL_USE + value: + _default: "0" + + secretEnvs: + - name: POSTGRES_USER + secretName: + _default: "postgres-secret" + secretKey: "username" + + - name: POSTGRES_PASSWORD + secretName: + _default: "postgres-secret" + secretKey: "password" + + - name: POSTGRES_DB + secretName: + _default: "postgres-secret" + secretKey: "database" + + - name: PUBLIC_KEY + secretName: + _default: "public-key" + secretKey: "key" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/projects/wb/frontend.yaml b/apps/projects/wb/frontend.yaml new file mode 100644 index 0000000..338312a --- /dev/null +++ b/apps/projects/wb/frontend.yaml @@ -0,0 +1,95 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: projects-frontend-static + namespace: projects + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + projects-frontend-static: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/project-frontend-app:wb_fd49eb19 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: projects-frontend-static + + replicaCount: + _default: 2 + + port: + _default: 80 + + resources: + requests: + cpu: + _default: 100m + memory: + _default: 100Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: projects-frontend-static-service + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 80 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/projects/wb/kustomization.yaml b/apps/projects/wb/kustomization.yaml index 10e9d38..f339513 100644 --- a/apps/projects/wb/kustomization.yaml +++ b/apps/projects/wb/kustomization.yaml @@ -3,4 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: projects resources: - - ../base + - frontend.yaml diff --git a/apps/reviews/wb/frontend.yaml b/apps/reviews/wb/frontend.yaml new file mode 100644 index 0000000..5d32c6d --- /dev/null +++ b/apps/reviews/wb/frontend.yaml @@ -0,0 +1,95 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: frontend + namespace: reviews + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + frontend: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/reviews-frontend:contour_3a66be35 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: frontend + + replicaCount: + _default: 1 + + port: + _default: 80 + + resources: + requests: + cpu: + _default: 100m + memory: + _default: 100Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: frontend-service + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 80 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/reviews/wb/kustomization.yaml b/apps/reviews/wb/kustomization.yaml index fe5409b..da4b5a2 100644 --- a/apps/reviews/wb/kustomization.yaml +++ b/apps/reviews/wb/kustomization.yaml @@ -3,4 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: reviews resources: - - ../base + - frontend.yaml diff --git a/apps/rfi/wb/backend.yaml b/apps/rfi/wb/backend.yaml new file mode 100644 index 0000000..0937db7 --- /dev/null +++ b/apps/rfi/wb/backend.yaml @@ -0,0 +1,203 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: rfi-backend-api + namespace: rfi + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + api: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/rfi-backend:production_d1e2e80d + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: rfi-backend-api + + replicaCount: + _default: 1 + + port: + _default: 8000 + + resources: + requests: + cpu: + _default: "1" + memory: + _default: 1Gi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: rfi-backend-api-svc + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + envs: + - name: JWT_AUTH_ENABLE + value: + _default: "True" + + - name: NOTIFICATIONS_ENABLE + value: + _default: "false" + + - name: NOTIFICATIONS_EMAIL_FROM + value: + _default: "hello@sarex.io" + + - name: NOTIFICATIONS_SERVICE_URL + value: + _default: "https://srx.wb.ru/rfi" + + - name: SAREX_BACKEND_URL + value: + _default: "http://backend.django.svc.cluster.local:8000" + + - name: EAV_URL + value: + _default: "http://eav-service.eav.svc.cluster.local:8000" + + - name: GATEWAY_URL + value: + _default: "http://pdm-api.documentations.svc.cluster.local:8080" + + - name: RABBITMQ_PORT + value: + _default: "5672" + + - name: RABBITMQ_HOST + value: + _default: "rabbitmq.rabbitmq.svc.cluster.local" + + secretEnvs: + - name: DJANGO_SECRET_KEY + secretName: + _default: "django-secret" + secretKey: "django_secret_key" + + - name: DB_HOST + secretName: + _default: "postgres-secret" + secretKey: "host" + + - name: DB_PORT + secretName: + _default: "postgres-secret" + secretKey: "port" + + - name: DB_NAME + secretName: + _default: "postgres-secret" + secretKey: "dbname" + + - name: DB_USER + secretName: + _default: "postgres-secret" + secretKey: "user" + + - name: DB_PASSWORD + secretName: + _default: "postgres-secret" + secretKey: "password" + + - name: SAREX_BACKEND_AUTH + secretName: + _default: "django-secret" + secretKey: "token" + + - name: YC_S3_ACCESS_KEY_ID + secretName: + _default: "s3-secret" + secretKey: "key_id" + + - name: YC_S3_SECRET_ACCESS_KEY + secretName: + _default: "s3-secret" + secretKey: "access_key" + + - name: YC_S3_BUCKET_NAME + secretName: + _default: "s3-secret" + secretKey: "storage_bucket_name" + + - name: YC_S3_ENDPOINT_URL + secretName: + _default: "s3-secret" + secretKey: "endpoint_url" + + - name: RABBITMQ_VHOST + secretName: + _default: "rabbitmq-secret" + secretKey: "vhost" + + - name: RABBITMQ_USERNAME + secretName: + _default: "rabbitmq-secret" + secretKey: "username" + + - name: RABBITMQ_PASSWORD + secretName: + _default: "rabbitmq-secret" + secretKey: "password" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/rfi/wb/celery.yaml b/apps/rfi/wb/celery.yaml new file mode 100644 index 0000000..e56fd06 --- /dev/null +++ b/apps/rfi/wb/celery.yaml @@ -0,0 +1,193 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: celery + namespace: rfi + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + celery: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/rfi-backend:production_d1e2e80d + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: celery + + replicaCount: + _default: 1 + + port: + _default: 8000 + + command: + _default: ["uv"] + args: + _default: ["run", "celery", "-A", "config", "worker", "-l", "info"] + + resources: + requests: + cpu: + _default: "1" + memory: + _default: 1Gi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + envs: + - name: JWT_AUTH_ENABLE + value: + _default: "True" + + - name: NOTIFICATIONS_ENABLE + value: + _default: "false" + + - name: NOTIFICATIONS_EMAIL_FROM + value: + _default: "hello@sarex.io" + + - name: NOTIFICATIONS_SERVICE_URL + value: + _default: "https://lk.srx.wb.ru:30443/rfi" + + - name: SAREX_BACKEND_URL + value: + _default: "http://backend.django.svc.cluster.local:8000" + + - name: EAV_URL + value: + _default: "http://eav-service.eav.svc.cluster.local:8000" + + - name: GATEWAY_URL + value: + _default: "http://pdm-api.documentations.svc.cluster.local:8080" + + - name: RABBITMQ_PORT + value: + _default: "5672" + + - name: RABBITMQ_HOST + value: + _default: "rabbitmq.rabbitmq.svc.cluster.local" + + secretEnvs: + - name: DJANGO_SECRET_KEY + secretName: + _default: "django-secret" + secretKey: "django_secret_key" + + - name: DB_HOST + secretName: + _default: "postgres-secret" + secretKey: "host" + + - name: DB_PORT + secretName: + _default: "postgres-secret" + secretKey: "port" + + - name: DB_NAME + secretName: + _default: "postgres-secret" + secretKey: "dbname" + + - name: DB_USER + secretName: + _default: "postgres-secret" + secretKey: "user" + + - name: DB_PASSWORD + secretName: + _default: "postgres-secret" + secretKey: "password" + + - name: SAREX_BACKEND_AUTH + secretName: + _default: "django-secret" + secretKey: "token" + + - name: YC_S3_ACCESS_KEY_ID + secretName: + _default: "s3-secret" + secretKey: "key_id" + + - name: YC_S3_SECRET_ACCESS_KEY + secretName: + _default: "s3-secret" + secretKey: "access_key" + + - name: YC_S3_BUCKET_NAME + secretName: + _default: "s3-secret" + secretKey: "storage_bucket_name" + + - name: YC_S3_ENDPOINT_URL + secretName: + _default: "s3-secret" + secretKey: "endpoint_url" + + - name: RABBITMQ_VHOST + secretName: + _default: "rabbitmq-secret" + secretKey: "vhost" + + - name: RABBITMQ_USERNAME + secretName: + _default: "rabbitmq-secret" + secretKey: "username" + + - name: RABBITMQ_PASSWORD + secretName: + _default: "rabbitmq-secret" + secretKey: "password" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/rfi/wb/frontend.yaml b/apps/rfi/wb/frontend.yaml new file mode 100644 index 0000000..b12ba54 --- /dev/null +++ b/apps/rfi/wb/frontend.yaml @@ -0,0 +1,95 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: rfi-frontend + namespace: rfi + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + rfi-frontend: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/rfi-frontend:production_b827756f_wb + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: rfi-frontend + + replicaCount: + _default: 1 + + port: + _default: 80 + + resources: + requests: + cpu: + _default: 100m + memory: + _default: 100Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: rfi-frontend-service + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 80 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/rfi/wb/kustomization.yaml b/apps/rfi/wb/kustomization.yaml index f445a0f..7413c58 100644 --- a/apps/rfi/wb/kustomization.yaml +++ b/apps/rfi/wb/kustomization.yaml @@ -3,4 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: rfi resources: - - ../base + - backend.yaml + - celery.yaml + - frontend.yaml diff --git a/apps/subscriptions/wb/backend.yaml b/apps/subscriptions/wb/backend.yaml new file mode 100644 index 0000000..3cedbac --- /dev/null +++ b/apps/subscriptions/wb/backend.yaml @@ -0,0 +1,203 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: sarex-subscriptions + namespace: subscriptions + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + sarex-subscriptions: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/subscriptions:prod_a50928e1 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: sarex-subscriptions + + replicaCount: + _default: 1 + + port: + _default: 8000 + + resources: + requests: + cpu: + _default: "1" + memory: + _default: 512Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: sarex-subscriptions-service + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + volumes: + _default: + - name: uwsgi-configmap + mountPath: + _default: /opt/server/uwsgi.ini + subPath: + _default: uwsgi.ini + readOnly: + _default: true + configMap: + name: + _default: uwsgi-configmap + items: + - key: uwsgi.ini + path: + _default: uwsgi.ini + + - name: django-configmap + mountPath: + _default: /server/config/settings/production.py + subPath: + _default: production.py + readOnly: + _default: true + configMap: + name: + _default: django-configmap + items: + - key: production.py + path: + _default: production.py + + envs: + - name: DATABASE_HOST + value: + _default: "sarex-vpsql-01.xc.wb.ru" + + - name: DATABASE_PORT + value: + _default: "5432" + + - name: DATABASE_NAME + value: + _default: "subscriptions_db" + + - name: API_ADDRESS + value: + _default: "8000" + + - name: SYSTEM_LOG_HOST + value: + _default: "http://api-service.system-log" + + - name: USER_SERVICE_HOST + value: + _default: "http://backend.django.svc.cluster.local:8000" + + - name: IS_USE_TELEGRAM + value: + _default: "false" + + - name: IS_MAILGUN_USE + value: + _default: "0" + + - name: SMTP_EMAIL_FROM + value: + _default: "sarex@rwb.ru" + + - name: SMTP_EMAIL_HOST + value: + _default: "mail.rwb.ru" + + - name: SMTP_EMAIL_PORT + value: + _default: "465" + + secretEnvs: + - name: DATABASE_USER + secretName: + _default: "postgres-secret" + secretKey: "username" + + - name: DATABASE_PASSWORD + secretName: + _default: "postgres-secret" + secretKey: "password" + + - name: YC_S3_ACCESS_KEY_ID + secretName: + _default: "yc-s3-secret" + secretKey: "key_id" + + - name: YC_S3_SECRET_ACCESS_KEY + secretName: + _default: "yc-s3-secret" + secretKey: "access_key" + + - name: YC_S3_BUCKET_NAME + secretName: + _default: "yc-s3-secret" + secretKey: "storage_bucket_name" + + - name: YC_S3_ENDPOINT_URL + secretName: + _default: "yc-s3-secret" + secretKey: "endpoint_url" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/subscriptions/wb/django-configmap.yaml b/apps/subscriptions/wb/django-configmap.yaml new file mode 100644 index 0000000..3fb50fc --- /dev/null +++ b/apps/subscriptions/wb/django-configmap.yaml @@ -0,0 +1,102 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: django-configmap + namespace: subscriptions +data: + production.py: | + import os + + from .base import * + + # DEBUG SETTINGS START + # ----------------------------------------------------------------------------- + DEBUG = False + # ----------------------------------------------------------------------------- + # DEBUG SETTINGS END + + + # ALLOWED HOSTS START + # ----------------------------------------------------------------------------- + ALLOWED_HOSTS = ["*"] + # ----------------------------------------------------------------------------- + # ALLOWED HOSTS END + + # DATABASE CONFIGURATION START + # ------------------------------------------------------------------------------ + POSTGRES_DATABASE = os.getenv("DATABASE_NAME") + POSTGRES_USER = os.getenv("DATABASE_USER") + POSTGRES_PASSWORD = os.getenv("DATABASE_PASSWORD") + POSTGRES_HOST = os.getenv("DATABASE_HOST") + POSTGRES_PORT = os.getenv("DATABASE_PORT") + + DATABASES = { + "default": { + "ENGINE": "core.db.backends.postgis", + "NAME": POSTGRES_DATABASE, + "USER": POSTGRES_USER, + "PASSWORD": POSTGRES_PASSWORD, + "HOST": POSTGRES_HOST, + "PORT": POSTGRES_PORT, + } + } + # DATABASE CONFIGURATION END + # ------------------------------------------------------------------------------ + + + CORS_ALLOWED_ORIGINS = [ + "https://localhost.8000", + "https://localhost.8080", + ] + + CORS_ALLOW_ALL_ORIGINS = True + + CORS_ALLOW_METHODS = [ + "DELETE", + "GET", + "OPTIONS", + "PATCH", + "POST", + "PUT", + ] + + # MAILGUN START + # ------------------------------------------------------------------------------ + MAILGUN_BASE_URL = os.getenv("MAILGUN_BASE_URL", default="https://api.mailgun.net/v3/mg.sarex.io") + MAILGUN_API_KEY = os.getenv("MAILGUN_API_KEY", default="6383b2d1b300a70b3b686fa1d0f684f8-f45b080f-53294ebe") + IS_MAILGUN_USE = os.getenv("IS_MAILGUN_USE", default=False) + MAILGUN_EMAIL_FROM = os.getenv("MAILGUN_EMAIL_FROM", default="hello@sarex.io") + # ------------------------------------------------------------------------------ + # MAILGUN END + + # SYSTEM_LOG SERVICE SETTINGS START + # ----------------------------------------------------------------------------- + SYSTEM_LOG_HOST = os.getenv("SYSTEM_LOG_HOST") + # ----------------------------------------------------------------------------- + # SYSTEM_LOG SERVICE SETTINGS END + + + # TELEGRAM SETTINGS START + # ----------------------------------------------------------------------------- + IS_USE_TELEGRAM = os.getenv("IS_USE_TELEGRAM", default=False) + TELEGRAM_BOT_TOKEN = os.getenv("TELEGRAM_BOT_TOKEN", default="6174421650:AAGEicmX0fvDX2683LXiGweWfn1U9UTQHFY") + # ----------------------------------------------------------------------------- + # TELEGRAM SETTINGS END + + # USER SERVICE SETTINGS START + # ----------------------------------------------------------------------------- + USER_SERVICE_HOST = os.getenv("USER_SERVICE_HOST") + USER_SERVICE_LOGIN = "hagen013" + USER_SERVICE_PASSWORD = "zealot096" + # ----------------------------------------------------------------------------- + # USER SERVICE SETTINGS END + + + # SMTP + # ------------------------------------------- + SMTP_EMAIL_HOST = os.getenv("SMTP_EMAIL_HOST", default=None) + SMTP_EMAIL_PORT = os.getenv("SMTP_EMAIL_PORT", default=None) + SMTP_EMAIL_FROM = os.getenv("SMTP_EMAIL_FROM", default="hello@sarex.io") + # ------------------------------------------- + # SMTP diff --git a/apps/subscriptions/wb/kustomization.yaml b/apps/subscriptions/wb/kustomization.yaml index 17b29cf..238b328 100644 --- a/apps/subscriptions/wb/kustomization.yaml +++ b/apps/subscriptions/wb/kustomization.yaml @@ -3,9 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: subscriptions resources: - - ../base -patches: - - path: patch.yaml - target: - kind: Deployment - name: sarex-subscriptions + - uwsgi-configmap.yaml + - django-configmap.yaml + - backend.yaml diff --git a/apps/subscriptions/wb/patch.yaml b/apps/subscriptions/wb/patch.yaml deleted file mode 100644 index 0240e95..0000000 --- a/apps/subscriptions/wb/patch.yaml +++ /dev/null @@ -1,22 +0,0 @@ ---- -# В base MinIO-шаблон зашит на YC_S3_ENDPOINT_URL=https://minio.contour.infra.sarex.tech -# и YC_S3_BUCKET_NAME=subscriptions — недоступно и не тот бакет для wb. -# Реальные значения — из terraform 1.yaml (infrastructure.minio.apps.subscriptions -# для wb): client.endpoint=http://minio-svc.minio.svc.cluster.local:9000, -# buckets[0].name=sarex-stage-storage-new. -apiVersion: apps/v1 -kind: Deployment -metadata: - name: sarex-subscriptions - namespace: subscriptions -spec: - template: - metadata: - annotations: - vault.hashicorp.com/agent-inject-template-subscriptions-minio: |- - {{- with secret "secrets/data/minio/apps/subscriptions" -}} - YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }} - YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }} - YC_S3_BUCKET_NAME=sarex-stage-storage-new - YC_S3_ENDPOINT_URL=http://minio-svc.minio.svc.cluster.local:9000 - {{- end -}} diff --git a/apps/subscriptions/wb/uwsgi-configmap.yaml b/apps/subscriptions/wb/uwsgi-configmap.yaml new file mode 100644 index 0000000..19373e1 --- /dev/null +++ b/apps/subscriptions/wb/uwsgi-configmap.yaml @@ -0,0 +1,22 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: uwsgi-configmap + namespace: subscriptions +data: + uwsgi.ini: | + [uwsgi] + chdir = /server + module = config.wsgi:application + master = true + master-fifo = /opt/server/uwsgi-backend-server.fifo + processes = 8 + http = 0.0.0.0:8000 + chmod-socket = 666 + vacuum = true + harakiri = 6000 + buffer-size = 32768 + + static-map = /static=/opt/server/static/ + static-map = /media=/opt/server/media/ diff --git a/apps/system-log/wb/api.yaml b/apps/system-log/wb/api.yaml new file mode 100644 index 0000000..8b74ab3 --- /dev/null +++ b/apps/system-log/wb/api.yaml @@ -0,0 +1,196 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: api + namespace: system-log + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + api: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/system-log:prod_6ed1b27e + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: api + + replicaCount: + _default: 1 + + port: + _default: 8000 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: api-service + + type: + _default: ClusterIP + + port: + _default: 8000 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + envs: + - name: KAFKA_ENABLE + value: + _default: "0" + + - name: KAFKA_BROKERS + value: + _default: "localhost:9091" + + - name: KAFKA_GROUP + value: + _default: "system-log-stage" + + - name: KAFKA_CLIENT_ID + value: + _default: "system-log-stage" + + - name: KAFKA_USE_SSL + value: + _default: "0" + + - name: KAFKA_ENABLE_LOGGING + value: + _default: "0" + + - name: KAFKA_TOPIC + value: + _default: "topic" + + - name: APP_NAME + value: + _default: "system_log" + + - name: APP_VERSION + value: + _default: "0.0.1" + + - name: LOG_LEVEL + value: + _default: "INFO" + + - name: HTTP_HOST + value: + _default: "0.0.0.0" + + - name: HTTP_PORT + value: + _default: "8000" + + - name: NAMESPACE + value: + _default: "system-log" + + - name: POSTGRES_ADDRESS + value: + _default: "sarex-vpsql-01.xc.wb.ru" + + - name: POSTGRES_PORT + value: + _default: "5432" + + - name: POSTGRES_DB + value: + _default: "system_log_db" + + - name: POSTGRES_POOL_SIZE + value: + _default: "3" + + - name: ENABLE_SSL + value: + _default: "0" + + - name: DJANGO_HOST + value: + _default: "http://backend.django.svc.cluster.local:8000" + + secretEnvs: + - name: POSTGRES_USER + secretName: + _default: "postgres-secret" + secretKey: "username" + + - name: POSTGRES_PASSWORD + secretName: + _default: "postgres-secret" + secretKey: "password" + + - name: KAFKA_USERNAME + secretName: + _default: "ya-kafka-secret" + secretKey: "username" + + - name: KAFKA_PASSWORD + secretName: + _default: "ya-kafka-secret" + secretKey: "password" + + - name: KAFKA_PEM_CERT + secretName: + _default: "yc-kafka-certificate" + secretKey: "certificate" + + - name: KAFKA_PEM_PATH + secretName: + _default: "yc-kafka-certificate" + secretKey: "certificate" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/system-log/wb/kustomization.yaml b/apps/system-log/wb/kustomization.yaml index 92cb30e..4cacc11 100644 --- a/apps/system-log/wb/kustomization.yaml +++ b/apps/system-log/wb/kustomization.yaml @@ -3,4 +3,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: system-log resources: - - ../base + - api.yaml + - worker.yaml diff --git a/apps/system-log/wb/worker.yaml b/apps/system-log/wb/worker.yaml new file mode 100644 index 0000000..775dab8 --- /dev/null +++ b/apps/system-log/wb/worker.yaml @@ -0,0 +1,147 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: worker + namespace: system-log + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + worker: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/system_log_worker:de6a0147d285afa273e85c0f074c8b6049d03a32 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: worker + + replicaCount: + _default: 1 + + port: + _default: 8000 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + envs: + - name: APP_NAME + value: + _default: "system_log" + + - name: APP_VERSION + value: + _default: "0.0.1" + + - name: LOG_LEVEL + value: + _default: "INFO" + + - name: HTTP_HOST + value: + _default: "0.0.0.0" + + - name: HTTP_PORT + value: + _default: "8000" + + - name: NAMESPACE + value: + _default: "sarex-system-log" + + - name: DOCUMENTATIONS_URL + value: + _default: "http://documentations-api.documentations.svc.cluster.local:8080" + + - name: POSTGRES_ADDRESS + value: + _default: "sarex-vpsql-01.xc.wb.ru" + + - name: POSTGRES_PORT + value: + _default: "5432" + + - name: POSTGRES_DB + value: + _default: "system_log_db" + + - name: POSTGRES_POOL_SIZE + value: + _default: "3" + + - name: ENABLE_SSL + value: + _default: "0" + + - name: DJANGO_HOST + value: + _default: "http://backend.django.svc.cluster.local:8000" + + secretEnvs: + - name: POSTGRES_USER + secretName: + _default: "postgres-secret" + secretKey: "username" + + - name: POSTGRES_PASSWORD + secretName: + _default: "postgres-secret" + secretKey: "password" + + - name: SUPER_USERNAME + secretName: + _default: "superuser" + secretKey: "username" + + - name: SUPER_PASSWORD + secretName: + _default: "superuser" + secretKey: "password" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/transmittal/wb/backend.yaml b/apps/transmittal/wb/backend.yaml index 1123230..3d6ca0a 100644 --- a/apps/transmittal/wb/backend.yaml +++ b/apps/transmittal/wb/backend.yaml @@ -1,26 +1,94 @@ --- -# Патч backend для контура wb. -# -# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch), -# поэтому здесь продублирован весь набор из apps/transmittal/base/backend.yaml. -# -# TRANSMITTAL_SERVICE_APP__HOST в base смотрит на тестовый контур -# (sarex.contour.infra.sarex.tech) — apps/transmittal/base/worker.yaml уже -# использует правильный для wb https://lk.srx.wb.ru:30443/transmittal, -# переносим то же значение сюда. -# TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT в base — заглушка -# minio.minio.svc.cluster.local:9000. Из terraform 1.yaml -# (infrastructure.minio.apps.transmittal для wb): client.endpoint=http://10.49.10.90:9000 -# (бакет — уже динамически из vault, buckets[0].name=transmittal). apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: - name: backend + name: transmittal namespace: transmittal + spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: - backend: + transmittal: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/transmittal-api:prod_a9d879ae + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: transmittal + + replicaCount: + _default: 1 + + port: + _default: 8000 + + resources: + requests: + cpu: + _default: "1" + memory: + _default: 1Gi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: transmittal-service + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + envs: - name: TRANSMITTAL_SERVICE_APP__NAME value: @@ -32,7 +100,7 @@ spec: - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__BASE_URL value: - _default: "http://backend-svc.flows.svc.cluster.local:80" + _default: "http://backend-service.flows.svc.cluster.local:8000" - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_CONNECTIONS value: @@ -114,14 +182,26 @@ spec: value: _default: "2" - - name: TRANSMITTAL_SERVICE_UVICORN__ROOT_PATH + - name: TRANSMITTAL_SERVICE_DATABASE__HOST value: - _default: "" + _default: "sarex-vpsql-01.xc.wb.ru" + + - name: TRANSMITTAL_SERVICE_DATABASE__PORT + value: + _default: "5432" + + - name: TRANSMITTAL_SERVICE_DATABASE__NAME + value: + _default: "transmittal_db" - name: TRANSMITTAL_SERVICE_DATABASE__ENABLE_SSL value: _default: "false" + - name: TRANSMITTAL_SERVICE_RABBITMQ__VHOST + value: + _default: "transmitalls" + - name: TRANSMITTAL_SERVICE_RABBITMQ__HOST value: _default: "rabbitmq.rabbitmq.svc.cluster.local" @@ -132,7 +212,7 @@ spec: - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASE_URL value: - _default: "http://backend-svc.django.svc.cluster.local:80" + _default: "http://backend.django.svc.cluster.local:8000" - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_CONNECTIONS value: @@ -148,7 +228,7 @@ spec: - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__BASE_URL value: - _default: "http://iam-backend.iam.svc.cluster.local:8000" + _default: "http://resources-service.resources.svc.cluster.local:8000" - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_CONNECTIONS value: @@ -164,7 +244,7 @@ spec: - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__BASE_URL value: - _default: "http://backend-api-svc.documentations.svc.cluster.local:80" + _default: "http://documentations-api.documentations.svc.cluster.local:8080" - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_CONNECTIONS value: @@ -198,6 +278,10 @@ spec: value: _default: "true" + - name: TRANSMITTAL_SERVICE_S3_CLIENT__DEFAULT_BUCKET + value: + _default: "transmittal-storage" + - name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT value: _default: "10.49.10.90:9000" @@ -257,3 +341,59 @@ spec: - name: TRANSMITTAL_SERVICE_MAILGUN__EMAIL value: _default: "hello@wb.io" + + secretEnvs: + - name: TRANSMITTAL_SERVICE_DATABASE__USER + secretName: + _default: "postgres-secret" + secretKey: "username" + + - name: TRANSMITTAL_SERVICE_DATABASE__PASSWORD + secretName: + _default: "postgres-secret" + secretKey: "password" + + - name: YC-PG-CERTIFICATE + secretName: + _default: "postgres-secret" + secretKey: "certificate" + + - name: TRANSMITTAL_SERVICE_AUTH__PUBLIC_KEY + secretName: + _default: "public-key" + secretKey: "key" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASIC_AUTH_ENCODED + secretName: + _default: "django-auth" + secretKey: "key" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__ACCESS_KEY + secretName: + _default: "s3-secret" + secretKey: "access_key" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__SECRET_KEY + secretName: + _default: "s3-secret" + secretKey: "secret_key" + + - name: TRANSMITTAL_SERVICE_RABBITMQ__USER + secretName: + _default: "rabbitmq-cred" + secretKey: "username" + + - name: TRANSMITTAL_SERVICE_RABBITMQ__PASSWORD + secretName: + _default: "rabbitmq-cred" + secretKey: "password" + + - name: TRANSMITTAL_SERVICE_MAILGUN__API_KEY + secretName: + _default: "mailgun-cred" + secretKey: "api_key" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/transmittal/wb/frontend.yaml b/apps/transmittal/wb/frontend.yaml new file mode 100644 index 0000000..09c86fc --- /dev/null +++ b/apps/transmittal/wb/frontend.yaml @@ -0,0 +1,95 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: transmittal-frontend-static + namespace: transmittal + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + transmittal-frontend-static: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/transmittal-frontend:wb_39cc8f57 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: transmittal-frontend-static + + replicaCount: + _default: 1 + + port: + _default: 80 + + resources: + requests: + cpu: + _default: 100m + memory: + _default: 100Mi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: transmittal-frontend-static + + type: + _default: ClusterIP + + port: + _default: 80 + + targetPort: + _default: 80 + + portName: + _default: tcp + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/transmittal/wb/kustomization.yaml b/apps/transmittal/wb/kustomization.yaml index 2067e6f..5343e42 100644 --- a/apps/transmittal/wb/kustomization.yaml +++ b/apps/transmittal/wb/kustomization.yaml @@ -3,13 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: transmittal resources: - - ../base -patches: - - path: backend.yaml - target: - kind: HelmRelease - name: backend - - path: worker.yaml - target: - kind: HelmRelease - name: worker + - backend.yaml + - worker.yaml + - frontend.yaml diff --git a/apps/transmittal/wb/worker.yaml b/apps/transmittal/wb/worker.yaml index e5cd118..761be21 100644 --- a/apps/transmittal/wb/worker.yaml +++ b/apps/transmittal/wb/worker.yaml @@ -1,26 +1,94 @@ --- -# Патч worker для контура wb. -# -# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch), -# поэтому здесь продублирован весь набор из apps/transmittal/base/worker.yaml. -# -# TRANSMITTAL_SERVICE_APP__HOST в base уже https://lk.srx.wb.ru:30443/transmittal — -# не трогаем. Меняем только TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT — в base -# заглушка minio.minio.svc.cluster.local:9000, реальный адрес — из terraform -# 1.yaml (infrastructure.minio.apps.transmittal для wb): http://10.49.10.90:9000. apiVersion: helm.toolkit.fluxcd.io/v2 kind: HelmRelease metadata: name: worker namespace: transmittal + spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + values: + global: + env: _default + services: worker: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/transmittal-api:prod_a9d879ae + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: worker + + replicaCount: + _default: 1 + + port: + _default: 8000 + + command: + _default: ["taskiq", "worker", "--no-parse", "transmittal_service.tasks.broker:broker", "transmittal_service.tasks.transmittal.tasks", "transmittal_service.tasks.email.tasks"] + + resources: + requests: + cpu: + _default: "1" + memory: + _default: 1Gi + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: false + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + envs: + - name: TRANSMITTAL_SERVICE_APP__NAME + value: + _default: "Transmittal Service" + + - name: TRANSMITTAL_SERVICE_APP__LOG_LEVEL + value: + _default: "ERROR" + - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__BASE_URL value: - _default: "http://backend-svc.flows.svc.cluster.local:8000" + _default: "http://backend-service.flows.svc.cluster.local:8000" - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_CONNECTIONS value: @@ -34,14 +102,6 @@ spec: value: _default: "30" - - name: TRANSMITTAL_SERVICE_APP__NAME - value: - _default: "Transmittal Service" - - - name: TRANSMITTAL_SERVICE_APP__LOG_LEVEL - value: - _default: "ERROR" - - name: TRANSMITTAL_SERVICE_APP__HOST value: _default: "https://lk.srx.wb.ru:30443/transmittal" @@ -110,14 +170,26 @@ spec: value: _default: "2" - - name: TRANSMITTAL_SERVICE_UVICORN__ROOT_PATH + - name: TRANSMITTAL_SERVICE_DATABASE__HOST value: - _default: "" + _default: "sarex-vpsql-01.xc.wb.ru" + + - name: TRANSMITTAL_SERVICE_DATABASE__PORT + value: + _default: "5432" + + - name: TRANSMITTAL_SERVICE_DATABASE__NAME + value: + _default: "transmittal_db" - name: TRANSMITTAL_SERVICE_DATABASE__ENABLE_SSL value: _default: "false" + - name: TRANSMITTAL_SERVICE_RABBITMQ__VHOST + value: + _default: "transmitalls" + - name: TRANSMITTAL_SERVICE_RABBITMQ__HOST value: _default: "rabbitmq.rabbitmq.svc.cluster.local" @@ -160,7 +232,7 @@ spec: - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__BASE_URL value: - _default: "http://backend-api-svc.documentations.svc.cluster.local:80" + _default: "http://documentations-api.documentations.svc.cluster.local:8080" - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_CONNECTIONS value: @@ -194,6 +266,10 @@ spec: value: _default: "true" + - name: TRANSMITTAL_SERVICE_S3_CLIENT__DEFAULT_BUCKET + value: + _default: "transmittal-storage" + - name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT value: _default: "10.49.10.90:9000" @@ -253,3 +329,59 @@ spec: - name: TRANSMITTAL_SERVICE_MAILGUN__EMAIL value: _default: "hello@wb.io" + + secretEnvs: + - name: TRANSMITTAL_SERVICE_DATABASE__USER + secretName: + _default: "postgres-secret" + secretKey: "username" + + - name: TRANSMITTAL_SERVICE_DATABASE__PASSWORD + secretName: + _default: "postgres-secret" + secretKey: "password" + + - name: YC-PG-CERTIFICATE + secretName: + _default: "postgres-secret" + secretKey: "certificate" + + - name: TRANSMITTAL_SERVICE_AUTH__PUBLIC_KEY + secretName: + _default: "public-key" + secretKey: "key" + + - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASIC_AUTH_ENCODED + secretName: + _default: "django-auth" + secretKey: "key" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__ACCESS_KEY + secretName: + _default: "s3-secret" + secretKey: "access_key" + + - name: TRANSMITTAL_SERVICE_S3_CLIENT__SECRET_KEY + secretName: + _default: "s3-secret" + secretKey: "secret_key" + + - name: TRANSMITTAL_SERVICE_RABBITMQ__USER + secretName: + _default: "rabbitmq-cred" + secretKey: "username" + + - name: TRANSMITTAL_SERVICE_RABBITMQ__PASSWORD + secretName: + _default: "rabbitmq-cred" + secretKey: "password" + + - name: TRANSMITTAL_SERVICE_MAILGUN__API_KEY + secretName: + _default: "mailgun-cred" + secretKey: "api_key" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/workspaces/wb/api.yaml b/apps/workspaces/wb/api.yaml new file mode 100644 index 0000000..5f7b882 --- /dev/null +++ b/apps/workspaces/wb/api.yaml @@ -0,0 +1,169 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: workspaces-api + namespace: workspaces + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + workspaces-api: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/workspaces:prod_4961b1f1 + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: workspaces-api + + replicaCount: + _default: 1 + + port: + _default: 8000 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: workspaces-service + + type: + _default: ClusterIP + + port: + _default: 8000 + + targetPort: + _default: 8000 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + envs: + - name: POSTGRES_ADDRESS + value: + _default: "sarex-vpsql-01.xc.wb.ru" + + - name: POSTGRES_PORT + value: + _default: "5432" + + - name: POSTGRES_DB + value: + _default: "workspaces_db" + + - name: POSTGRES_POOL_SIZE + value: + _default: "3" + + - name: BUNDLES_RETRY_COUNT + value: + _default: "5" + + - name: BUNDLES_NJOBS + value: + _default: "5" + + - name: API_ADDRESS + value: + _default: "0.0.0.0:8000" + + - name: NAMESPACE + value: + _default: "workspaces" + + - name: ENABLE_SQL_QUERY + value: + _default: "0" + + - name: ENABLE_SSL + value: + _default: "0" + + - name: DOCUMENTATION_HOST + value: + _default: "http://documentations-api.documentations.svc.cluster.local:8080" + + - name: DOCUMENTATION_LOGGER_FEATURE + value: + _default: "0" + + - name: DOCUMENTATION_ORIGINATOR + value: + _default: "prod_ws" + + - name: ENVIRONMENT + value: + _default: "prod" + + - name: DJANGO_HOST + value: + _default: "http://backend.django.svc.cluster.local:8000" + + - name: DJANGO_ORIGINATOR + value: + _default: "docs_prod" + + secretEnvs: + - name: POSTGRES_USER + secretName: + _default: "postgres-secret" + secretKey: "username" + + - name: POSTGRES_PASSWORD + secretName: + _default: "postgres-secret" + secretKey: "password" + + - name: DJANGO_BASIC_AUTH + secretName: + _default: "django-auth" + secretKey: "key" + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/workspaces/wb/frontend.yaml b/apps/workspaces/wb/frontend.yaml new file mode 100644 index 0000000..bdb43c9 --- /dev/null +++ b/apps/workspaces/wb/frontend.yaml @@ -0,0 +1,88 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: workspaces-v2-frontend-static + namespace: workspaces + +spec: + interval: 10m + + chart: + spec: + chart: universal-chart + version: "0.1.7" + sourceRef: + kind: HelmRepository + name: yc-oci-charts + namespace: flux-system + interval: 10m + + install: + remediation: + retries: 3 + + upgrade: + remediation: + retries: 3 + + values: + global: + env: _default + + services: + workspaces-v2-frontend-static: + enabled: true + + image: + name: + _default: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_7f95769f + pullPolicy: + _default: IfNotPresent + + deployment: + enabled: true + + name: + _default: workspaces-v2-frontend-static + + replicaCount: + _default: 1 + + port: + _default: 8080 + + probes: + liveness: + enabled: false + readiness: + enabled: false + + service: + enabled: true + + name: + _default: workspaces-v2-frontend-static-service + + type: + _default: ClusterIP + + port: + _default: 8080 + + targetPort: + _default: 80 + + portName: + _default: http + + imagePullSecrets: + enabled: + _default: true + name: + _default: dockerhub + + commitSha: "" + gitlabUri: "" + gitlabJobUrl: "" + owner: "" diff --git a/apps/workspaces/wb/kustomization.yaml b/apps/workspaces/wb/kustomization.yaml index f84db91..973333f 100644 --- a/apps/workspaces/wb/kustomization.yaml +++ b/apps/workspaces/wb/kustomization.yaml @@ -3,4 +3,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: workspaces resources: - - ../base + - api.yaml + - frontend.yaml diff --git a/clusters/wb/kustomization.yaml b/clusters/wb/kustomization.yaml index 1bd580f..67ffcc1 100644 --- a/clusters/wb/kustomization.yaml +++ b/clusters/wb/kustomization.yaml @@ -8,3 +8,4 @@ resources: # apps - ../../apps/iam/wb - ../../apps/notes/wb + - ../../apps/rfi/wb