++

apps/attachments/wb/backend.yaml

@@ -0,0 +1,154 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: attachments
+  namespace: attachments
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      attachments:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/att9:dev
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: attachments
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: attachments-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: yc-s3
+              mountPath:
+                _default: /etc/sarex/yc-s3-storage
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: yc-s3
+
+        envs:
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "10"
+
+          - name: API_ADDRESS
+            value:
+              _default: "0.0.0.0:8000"
+
+          - name: YANDEX_S3_ACCOUNT_PATH
+            value:
+              _default: "/etc/sarex/yc-s3-storage/yc-s3-service-account.json"
+
+          - name: BUCKET_NAME
+            value:
+              _default: "attachments-storage"
+
+          - name: DATABASE_SSL_MODE
+            value:
+              _default: "disable"
+
+          - name: YANDEX_S3_VERIFY
+            value:
+              _default: "false"
+
+          - name: YANDEX_S3_USE_SSL
+            value:
+              _default: "false"
+
+        secretEnvs:
+          - name: DATABASE_HOST
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "host"
+
+          - name: DATABASE_PORT
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "port"
+
+          - name: DATABASE_NAME
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "database"
+
+          - name: DATABASE_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: DATABASE_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/attachments/wb/kustomization.yaml

@@ -3,9 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: attachments
 resources:
-  - ../base
+  - backend.yaml
-patches:
-  - path: patch.yaml
-    target:
-      kind: HelmRelease
-      name: attachments

apps/attachments/wb/patch.yaml

@@ -1,40 +0,0 @@
----
-# Эндпоинт MinIO для контура wb.
-#
-# В base зашит YANDEX_S3_ENDPOINT_URL=minio.minio:9000 — заглушка, недоступная
-# в кластере wb. Реальный адрес/бакет — из terraform 1.yaml (infrastructure.minio.apps.attachments
-# для wb): client.endpoint=http://10.49.10.90:9000, buckets[0].name=sarex-media-storage.
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: attachments
-  namespace: attachments
-spec:
-  values:
-    services:
-      attachments:
-        podAnnotations:
-          _default:
-            vault.hashicorp.com/auth-path: auth/kubernetes
-            vault.hashicorp.com/role: attachments
-            vault.hashicorp.com/agent-inject-secret-attachments-db: secrets/data/apps/attachments/postgres
-            vault.hashicorp.com/agent-inject-template-attachments-db: |-
-              {{- with secret "secrets/data/apps/attachments/postgres" -}}
-              DATABASE_HOST={{ index .Data.data "host" }}
-              DATABASE_PORT={{ index .Data.data "port" }}
-              DATABASE_NAME={{ index .Data.data "database" }}
-              DATABASE_USER={{ index .Data.data "username" }}
-              DATABASE_PASSWORD={{ index .Data.data "password" }}
-              DATABASE_SSL_MODE=disable
-              {{- end -}}
-            vault.hashicorp.com/agent-inject-secret-attachments-s3: secrets/data/minio/apps/attachments
-            vault.hashicorp.com/agent-inject-template-attachments-s3: |-
-              {{- with secret "secrets/data/minio/apps/attachments" -}}
-              YANDEX_S3_ENDPOINT_URL=10.49.10.90:9000
-              YANDEX_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
-              YANDEX_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
-              YANDEX_S3_USE_SSL=false
-              YANDEX_S3_REGION=ru-central
-              YANDEX_S3_VERIFY=false
-              BUCKET_NAME=sarex-media-storage
-              {{- end -}}

apps/bim/wb/backend.yaml

@@ -0,0 +1,222 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: bim
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      backend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/bim-backend-v2:donstroi1
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: backend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: backend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        envs:
+          - name: LAST_MASTER_BIM
+            value:
+              _default: "100000"
+
+          - name: LAST_MASTER_BIM_V3
+            value:
+              _default: "100000"
+
+          - name: LAST_SLAVE_1_BIM
+            value:
+              _default: "1000000"
+
+          - name: POSTGRES_ADDRESS
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: POSTGRES_PORT
+            value:
+              _default: "6432"
+
+          - name: POSTGRES_DB
+            value:
+              _default: "bim_db"
+
+          - name: DB_CERT_PATH_2
+            value:
+              _default: "/root/yandex_pg.pem"
+
+          - name: POSTGRES_ADDRESS_2
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: POSTGRES_PORT_2
+            value:
+              _default: "6432"
+
+          - name: POSTGRES_DB_2
+            value:
+              _default: "bim_db"
+
+          - name: DB_CERT_PATH_3
+            value:
+              _default: "/root/yandex_pg.pem"
+
+          - name: POSTGRES_ADDRESS_3
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: POSTGRES_PORT_3
+            value:
+              _default: "6432"
+
+          - name: POSTGRES_DB_3
+            value:
+              _default: "bim_db"
+
+          - name: DB_CERT_PATH_4
+            value:
+              _default: "/root/yandex_pg.pem"
+
+          - name: POSTGRES_ADDRESS_4
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: POSTGRES_PORT_4
+            value:
+              _default: "6432"
+
+          - name: POSTGRES_DB_4
+            value:
+              _default: "bim_db"
+
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "30"
+
+          - name: API_ADDRESS
+            value:
+              _default: "0.0.0.0:8000"
+
+          - name: DJANGO_HOST
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+          - name: ENABLE_SQL_QUERY
+            value:
+              _default: "0"
+
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+
+        secretEnvs:
+          - name: POSTGRES_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: POSTGRES_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: POSTGRES_USER_2
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: POSTGRES_PASSWORD_2
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: POSTGRES_USER_3
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: POSTGRES_PASSWORD_3
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: POSTGRES_USER_4
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: POSTGRES_PASSWORD_4
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/bim/wb/kustomization.yaml

@@ -3,4 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: bim
 resources:
-  - ../base
+  - backend.yaml

apps/checklists/wb/backend.yaml

@@ -0,0 +1,145 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: checklists-backend
+  namespace: checklists
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      checklists-backend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/checklists-backend:production_68f242cd
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: checklists-backend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: checklists-backend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        envs:
+          - name: HTTP_APP_HOST
+            value:
+              _default: "0.0.0.0"
+
+          - name: HTTP_APP_PORT
+            value:
+              _default: "8000"
+
+          - name: HTTP_APP_ROOT_PATH
+            value:
+              _default: "/checklists"
+
+          - name: HTTP_APP_WORKERS
+            value:
+              _default: "8"
+
+          - name: HTTP_APP_ADMIN_ENABLE
+            value:
+              _default: "true"
+
+          - name: DATABASE_HOST
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: DATABASE_PORT
+            value:
+              _default: "5432"
+
+          - name: DATABASE_NAME
+            value:
+              _default: "checklists_db"
+
+          - name: JWT_AUTH_ENABLE
+            value:
+              _default: "true"
+
+          - name: DEBUG
+            value:
+              _default: "false"
+
+        secretEnvs:
+          - name: DATABASE_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "user"
+
+          - name: DATABASE_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: JWT_AUTH_PUBLIC_KEY
+            secretName:
+              _default: "jwt-secret"
+            secretKey: "public-key"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/checklists/wb/kustomization.yaml

@@ -3,4 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: checklists
 resources:
-  - ../base
+  - backend.yaml

apps/contracts/wb/backend.yaml

@@ -0,0 +1,99 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: contracts
+  namespace: contracts
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      contracts:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/contracts:prod_d3bbd9fc
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: contracts
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8080
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: contracts-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8080
+
+          targetPort:
+            _default: 8080
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        secretEnvs:
+          - name: DB_URL
+            secretName:
+              _default: "ya-pg-secret"
+            secretKey: "db_url"
+
+          - name: PUBLIC_KEY
+            secretName:
+              _default: "public-key"
+            secretKey: "key"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/contracts/wb/kustomization.yaml

@@ -3,4 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: contracts
 resources:
-  - ../base
+  - backend.yaml

apps/django/wb/auth-flow-frontend.yaml

@@ -0,0 +1,97 @@
+---
+# auth-flow-frontend — компонент приложения auth-flow (apps/auth-flow),
+# в wb развёрнут в ns django, а не в своём собственном неймспейсе.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: auth-flow-frontend
+  namespace: django
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      auth-flow-frontend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/auth-flow-frontend:contour_fe9ea2a3
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: auth-flow-frontend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          resources:
+            requests:
+              cpu:
+                _default: 100m
+              memory:
+                _default: 128Mi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: auth-flow-frontend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/django/wb/backend.yaml

@@ -1,167 +1,444 @@
 ---
-# Патч backend для контура wb.
-#
-# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
-# поэтому здесь продублирован весь набор из apps/django/base/backend.yaml.
-# podAnnotations — map, мержится по ключам, поэтому переопределён только
-# agent-inject-template-django-s3; остальные vault-аннотации берутся из base.
-#
-# В base SERVER_API_HOST/SERVER_HOST/ZITADEL_HOST/S3 смотрят на тестовый
-# контур contour.infra.sarex.tech — для wb это srx.wb.ru / zitadel-srx.wb.ru
-# (см. apps/documentations/base — там те же домены уже дефолт) и свой MinIO
-# (terraform 1.yaml, infrastructure.minio.apps.django для wb: client.endpoint=http://10.49.10.90:9000).
-# WORKFLOWS_HOST в base смотрит на ns processing — в wb processing развёрнут
-# в ns workflow (apps/processing/wb), поэтому тоже поправлен.
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
   name: backend
   namespace: django
+
 spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
   values:
+    global:
+      env: _default
+
     services:
       backend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/backend:preprod_78a9bdc0
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: backend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: backend-svc
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: tmp-volume
+              mountPath:
+                _default: /tmp
+              emptyDir: {}
+
+            - name: uwsgi-configmap
+              mountPath:
+                _default: /opt/sarex/uwsgi.ini
+              subPath:
+                _default: uwsgi.ini
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: uwsgi-configmap
+                items:
+                  - key: uwsgi.ini
+                    path:
+                      _default: uwsgi.ini
+
+            - name: django-configmap
+              mountPath:
+                _default: /opt/sarex/config/settings/production.py
+              subPath:
+                _default: production.py
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: django-configmap
+                items:
+                  - key: production.py
+                    path:
+                      _default: production.py
+
+            - name: kafka-cert-volume
+              mountPath:
+                _default: /usr/local/share/ca-certificates
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: kafka-cert
+
         envs:
+          - name: GK_ENCRYPTION_KEY
+            value:
+              _default: "zfDjuszywHSbAhY8KJQbESbpUYN74XTs"
+
           - name: ALLOWED_HOSTS
             value:
               _default: "*"
+
           - name: SERVER_USE_CHANGELOG
             value:
               _default: "0"
+
           - name: SERVER_ZITADEL_ENABLED
             value:
               _default: "True"
+
           - name: DJANGO_SETTINGS_MODULE
             value:
-              _default: config.settings.production
+              _default: "config.settings.production"
+
           - name: CELERY_REDIS_HOST
             value:
-              _default: redis
+              _default: "redis-service"
+
           - name: CELERY_REDIS_PORT
             value:
               _default: "6379"
+
           - name: DJANGO_REDIS_HOST
             value:
-              _default: redis
+              _default: "redis-service"
-          - name: SERVER_EXTERNAL_FIND_BY_USERNAME_ENABLED
+
-            value:
-              _default: "True"
-          - name: SERVER_EXTERNAL_FIND_BY_EMAIL_ENABLED
-            value:
-              _default: "True"
           - name: DJANGO_REDIS_PORT
             value:
               _default: "6379"
+
           - name: BIMV2_INTERNAL_HOST
             value:
-              _default: http://bim-backend-v2-service.bim-api
+              _default: "http://bim-backend-v2-service.bim-api"
+
           - name: BIMV2_TIMEOUT
             value:
               _default: "60"
+
           - name: JWT_KID
             value:
               _default: "1"
+
           - name: PDM_SYNC
             value:
               _default: "1"
+
           - name: KC_SYNC_ENABLE
             value:
               _default: "0"
+
           - name: MEASUREMENTS_HOST
             value:
-              _default: http://measurements-service.measurements.svc.cluster.local:8000/api
+              _default: "http://measurements-service.measurements.svc.cluster.local:8000/api"
+
           - name: MEASUREMENTS_USE_MEASUREMENTS
             value:
               _default: "1"
+
+          - name: SERVER_EXTERNAL_FIND_BY_USERNAME_ENABLED
+            value:
+              _default: "True"
+
+          - name: SERVER_EXTERNAL_FIND_BY_EMAIL_ENABLED
+            value:
+              _default: "True"
+
           - name: SERVER_API_HOST
             value:
-              _default: https://srx.wb.ru
+              _default: "https://srx.wb.ru"
+
           - name: SERVER_HOST
             value:
-              _default: https://srx.wb.ru
+              _default: "https://srx.wb.ru"
+
           - name: WORKFLOWS_HOST
             value:
-              _default: http://backend-svc.workflow.svc.cluster.local:80
+              _default: "https://srx.wb.ru"
+
           - name: WORKFLOWS_BASE_HOST
             value:
-              _default: http://backend-svc.django.svc.cluster.local:80
+              _default: "https://srx.wb.ru"
-          - name: WORKFLOWS_PREFIX
+
-            value:
-              _default: /internal/v1
           - name: WORKFLOWS_USE
             value:
               _default: "1"
+
           - name: SERVER_S3_STREAM_IMPORT
             value:
               _default: "1"
+
           - name: SERVER_SAVE_DIFF_DEM
             value:
               _default: "1"
+
           - name: SERVER_USE_CLICKHOUSE
             value:
               _default: "0"
+
           - name: SERVER_USE_CREATE_COMPARED_GEOTIFF_TASK
             value:
               _default: "0"
+
           - name: SERVER_USE_DJANGO_STORAGE
             value:
               _default: "1"
+
           - name: SERVER_USE_METASHAPE
             value:
               _default: "0"
+
           - name: SERVER_CHANGELOG_MODE_SYSTEM_LOG
             value:
               _default: "1"
+
           - name: SERVER_CHANGELOG_MODE
             value:
               _default: "0"
+
           - name: SERVER_DJANGO_URLS
             value:
               _default: "1"
+
           - name: CHECK_IMPORT_HASH
             value:
               _default: "1"
+
           - name: EAV_ENABLE
             value:
               _default: "1"
+
           - name: SERVER_CHECK_IMPORT_HASH
             value:
               _default: "1"
+
           - name: SERVER_CHUNKED_PATH
             value:
-              _default: /tmp/chunked_uploads/%Y/%m/%d
+              _default: "/tmp/chunked_uploads/%Y/%m/%d"
+
           - name: SERVER_HIDE_USER_SCROLL_PERMISSIONS
             value:
               _default: "0"
+
           - name: SERVER_USE_WRORKFLOW_STATUS
             value:
               _default: "1"
+
           - name: ZITADEL_HOST
             value:
-              _default: https://zitadel-srx.wb.ru
+              _default: "https://zitadel-srx.wb.ru"
+
           - name: SERVER_KAFKA_ENABLED
             value:
-              _default: "False"
+              _default: "True"
+
           - name: KAFKA_TOPICS
             value:
               _default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}'
+
+          - name: KAFKA_BOOTSTRAP_SERVERS
+            value:
+              _default: '["wb-prod-kafka-bootstrap.kafka.svc.cluster.local:9093"]'
+
+          - name: KAFKA_SECURITY_PROTOCOL
+            value:
+              _default: "SSL"
+
+          - name: KAFKA_SASL_MECHANISM
+            value:
+              _default: "SCRAM-SHA-512"
+
           - name: KAFKA_SSL_CAFILE
             value:
-              _default: /usr/local/share/ca-certificates/kafka.crt
+              _default: "/usr/local/share/ca-certificates/kafka.crt"
+
+          - name: S3_HOST
+            value:
+              _default: "http://10.49.10.90:9000"
+
           - name: KC_USE_REDIRECT_LOGOUT
             value:
               _default: "False"
-        podAnnotations:
+
-          _default:
+        secretEnvs:
-            vault.hashicorp.com/agent-inject-template-django-s3: |-
+          - name: ZITADEL_ACCESS_TOKEN
-              {{- with secret "secrets/data/minio/apps/django" }}
+            secretName:
-              AWS_S3_ENDPOINT_URL=http://10.49.10.90:9000
+              _default: "zitadel-secret"
-              S3_HOST=http://10.49.10.90:9000
+            secretKey: "access_token"
-              {{- $buckets := index .Data.data "buckets" }}
+
-              S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }}
+          - name: KAFKA_SASL_PLAIN_USERNAME
-              S3_LOGIN={{ index .Data.data "access_key" }}
+            secretName:
-              S3_PASSWORD={{ index .Data.data "secret_key" }}
+              _default: "kafka-secret"
-              AWS_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
+            secretKey: "username"
-              AWS_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
+
-              AWS_STORAGE_BUCKET_NAME={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }}
+          - name: KAFKA_SASL_PLAIN_PASSWORD
-              {{- end }}
+            secretName:
+              _default: "kafka-secret"
+            secretKey: "password"
+
+          - name: KC_CLIENT_ID
+            secretName:
+              _default: "gatekeeper-secret"
+            secretKey: "client_id"
+
+          - name: KC_CLIENT_SECRET
+            secretName:
+              _default: "gatekeeper-secret"
+            secretKey: "client_secret"
+
+          - name: AWS_S3_ENDPOINT_URL
+            secretName:
+              _default: "s3-secret"
+            secretKey: "endpoint"
+
+          - name: CELERY_RABBITMQ_HOST
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "host"
+
+          - name: CELERY_RABBITMQ_USER
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "username"
+
+          - name: CELERY_RABBITMQ_PASSWORD
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "password"
+
+          - name: CELERY_RABBITMQ_VHOST
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "vhost"
+
+          - name: DJANGO_POSTGRES_HOST
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "host"
+
+          - name: DJANGO_POSTGRES_PORTS
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "port"
+
+          - name: DJANGO_POSTGRES_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: DJANGO_POSTGRES_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: DJANGO_POSTGRES_DATABASE
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "database"
+
+          - name: DJANGO_RABBIT_HOSTNAME
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "host"
+
+          - name: DJANGO_RABBIT_USER
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "username"
+
+          - name: DJANGO_RABBIT_PASS
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "password"
+
+          - name: DJANGO_RABBIT_VHOST
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "vhost"
+
+          - name: JWT_PRIVATE_KEY
+            secretName:
+              _default: "backend-secret"
+            secretKey: "ssh_private.key"
+
+          - name: JWT_PUBLIC_KEY
+            secretName:
+              _default: "backend-secret"
+            secretKey: "ssh_public.key"
+
+          - name: S3_BUCKET
+            secretName:
+              _default: "sarex-media-storage-secret"
+            secretKey: "bucket"
+
+          - name: S3_LOGIN
+            secretName:
+              _default: "sarex-media-storage-secret"
+            secretKey: "login"
+
+          - name: S3_PASSWORD
+            secretName:
+              _default: "sarex-media-storage-secret"
+            secretKey: "password"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/django/wb/celery.yaml

@@ -0,0 +1,428 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: celery
+  namespace: django
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      celery:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/backend:production_a96dead0
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: celery
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          command:
+            _default: ["celery", "-A", "config", "worker", "-B", "-l", "info", "-E", "-Q", "default", "-n", "default_worker.%h", "--concurrency=2"]
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: false
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: tmp-volume
+              mountPath:
+                _default: /tmp
+              emptyDir: {}
+
+            - name: uwsgi-configmap
+              mountPath:
+                _default: /opt/sarex/uwsgi.ini
+              subPath:
+                _default: uwsgi.ini
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: uwsgi-configmap
+                items:
+                  - key: uwsgi.ini
+                    path:
+                      _default: uwsgi.ini
+
+            - name: django-configmap
+              mountPath:
+                _default: /opt/sarex/config/settings/production.py
+              subPath:
+                _default: production.py
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: django-configmap
+                items:
+                  - key: production.py
+                    path:
+                      _default: production.py
+
+            - name: kafka-cert-volume
+              mountPath:
+                _default: /usr/local/share/ca-certificates
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: kafka-cert
+
+        envs:
+          - name: GK_ENCRYPTION_KEY
+            value:
+              _default: "zfDjuszywHSbAhY8KJQbESbpUYN74XTs"
+
+          - name: ALLOWED_HOSTS
+            value:
+              _default: "*"
+
+          - name: SERVER_USE_CHANGELOG
+            value:
+              _default: "0"
+
+          - name: SERVER_ZITADEL_ENABLED
+            value:
+              _default: "False"
+
+          - name: DJANGO_SETTINGS_MODULE
+            value:
+              _default: "config.settings.production"
+
+          - name: CELERY_REDIS_HOST
+            value:
+              _default: "redis-service"
+
+          - name: CELERY_REDIS_PORT
+            value:
+              _default: "6379"
+
+          - name: DJANGO_REDIS_HOST
+            value:
+              _default: "redis-service"
+
+          - name: CACHE_HOST
+            value:
+              _default: "redis.pm.svc.cluster.local"
+
+          - name: DJANGO_REDIS_PORT
+            value:
+              _default: "6379"
+
+          - name: BIMV2_INTERNAL_HOST
+            value:
+              _default: "http://bim-backend-v2-service.bim-api"
+
+          - name: BIMV2_TIMEOUT
+            value:
+              _default: "60"
+
+          - name: JWT_KID
+            value:
+              _default: "1"
+
+          - name: PDM_SYNC
+            value:
+              _default: "1"
+
+          - name: KC_SYNC_ENABLE
+            value:
+              _default: "0"
+
+          - name: MEASUREMENTS_HOST
+            value:
+              _default: "http://measurements-service.measurements.svc.cluster.local:8000/api"
+
+          - name: MEASUREMENTS_USE_MEASUREMENTS
+            value:
+              _default: "1"
+
+          - name: SERVER_API_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: SERVER_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: WORKFLOWS_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: WORKFLOWS_BASE_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: WORKFLOWS_USE
+            value:
+              _default: "1"
+
+          - name: SERVER_S3_STREAM_IMPORT
+            value:
+              _default: "1"
+
+          - name: SERVER_SAVE_DIFF_DEM
+            value:
+              _default: "1"
+
+          - name: SERVER_USE_CLICKHOUSE
+            value:
+              _default: "0"
+
+          - name: SERVER_USE_CREATE_COMPARED_GEOTIFF_TASK
+            value:
+              _default: "0"
+
+          - name: SERVER_USE_DJANGO_STORAGE
+            value:
+              _default: "1"
+
+          - name: SERVER_USE_METASHAPE
+            value:
+              _default: "0"
+
+          - name: SERVER_CHANGELOG_MODE_SYSTEM_LOG
+            value:
+              _default: "1"
+
+          - name: ZITADEL_HOST
+            value:
+              _default: "https://zitadel-srx.wb.ru"
+
+          - name: SERVER_KAFKA_ENABLED
+            value:
+              _default: "True"
+
+          - name: KAFKA_TOPICS
+            value:
+              _default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}'
+
+          - name: KAFKA_BOOTSTRAP_SERVERS
+            value:
+              _default: '["wb-prod-kafka-bootstrap.kafka.svc.cluster.local:9093"]'
+
+          - name: KAFKA_SECURITY_PROTOCOL
+            value:
+              _default: "SSL"
+
+          - name: KAFKA_SASL_MECHANISM
+            value:
+              _default: "SCRAM-SHA-512"
+
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: "/usr/local/share/ca-certificates/kafka.crt"
+
+          - name: SERVER_CHANGELOG_MODE
+            value:
+              _default: "0"
+
+          - name: SERVER_DJANGO_URLS
+            value:
+              _default: "1"
+
+          - name: CHECK_IMPORT_HASH
+            value:
+              _default: "1"
+
+          - name: EAV_ENABLE
+            value:
+              _default: "1"
+
+          - name: SERVER_CHECK_IMPORT_HASH
+            value:
+              _default: "1"
+
+          - name: SERVER_CHUNKED_PATH
+            value:
+              _default: "/tmp/chunked_uploads/%Y/%m/%d"
+
+          - name: SERVER_HIDE_USER_SCROLL_PERMISSIONS
+            value:
+              _default: "0"
+
+          - name: SERVER_USE_WRORKFLOW_STATUS
+            value:
+              _default: "1"
+
+          - name: S3_HOST
+            value:
+              _default: "http://10.49.10.90:9000"
+
+          - name: KC_USE_REDIRECT_LOGOUT
+            value:
+              _default: "False"
+
+        secretEnvs:
+          - name: ZITADEL_ACCESS_TOKEN
+            secretName:
+              _default: "zitadel-secret"
+            secretKey: "access_token"
+
+          - name: KAFKA_SASL_PLAIN_USERNAME
+            secretName:
+              _default: "kafka-secret"
+            secretKey: "username"
+
+          - name: KAFKA_SASL_PLAIN_PASSWORD
+            secretName:
+              _default: "kafka-secret"
+            secretKey: "password"
+
+          - name: KC_CLIENT_ID
+            secretName:
+              _default: "gatekeeper-secret"
+            secretKey: "client_id"
+
+          - name: KC_CLIENT_SECRET
+            secretName:
+              _default: "gatekeeper-secret"
+            secretKey: "client_secret"
+
+          - name: AWS_S3_ENDPOINT_URL
+            secretName:
+              _default: "s3-secret"
+            secretKey: "endpoint"
+
+          - name: CELERY_RABBITMQ_HOST
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "host"
+
+          - name: CELERY_RABBITMQ_USER
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "username"
+
+          - name: CELERY_RABBITMQ_PASSWORD
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "password"
+
+          - name: CELERY_RABBITMQ_VHOST
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "vhost"
+
+          - name: DJANGO_POSTGRES_HOST
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "host"
+
+          - name: DJANGO_POSTGRES_PORTS
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "port"
+
+          - name: DJANGO_POSTGRES_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: DJANGO_POSTGRES_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: DJANGO_POSTGRES_DATABASE
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "database"
+
+          - name: DJANGO_RABBIT_HOSTNAME
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "host"
+
+          - name: DJANGO_RABBIT_USER
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "username"
+
+          - name: DJANGO_RABBIT_PASS
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "password"
+
+          - name: DJANGO_RABBIT_VHOST
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "vhost"
+
+          - name: JWT_PRIVATE_KEY
+            secretName:
+              _default: "backend-secret"
+            secretKey: "ssh_private.key"
+
+          - name: JWT_PUBLIC_KEY
+            secretName:
+              _default: "backend-secret"
+            secretKey: "ssh_public.key"
+
+          - name: S3_BUCKET
+            secretName:
+              _default: "sarex-media-storage-secret"
+            secretKey: "bucket"
+
+          - name: S3_LOGIN
+            secretName:
+              _default: "sarex-media-storage-secret"
+            secretKey: "login"
+
+          - name: S3_PASSWORD
+            secretName:
+              _default: "sarex-media-storage-secret"
+            secretKey: "password"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/django/wb/django-configmap.yaml

@@ -0,0 +1,287 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: django-configmap
+  namespace: django
+data:
+  production.py: |
+
+    import os
+    from .base import *
+    from logging.handlers import SysLogHandler
+    from datetime import timedelta
+
+    ALLOWED_HOSTS = ["*"]
+    FILE_UPLOAD_PERMISSIONS = 0o644
+    DEBUG = False
+    CSRF_COOKIE_SECURE = True
+    CSRF_TRUSTED_ORIGINS = ["https://lk.srx.wb.ru:30443", "https://lk.srx.wb.ru"]
+    SESSION_COOKIE_SECURE = True
+    SECURE_SSL_REDIRECT = False
+
+    SECRET_KEY = 't2=9+($2f%7ptsdy4!rby$)mcfl1l%o2e@vs^d(g&(wwi&%k1v'
+
+    CORS_ORIGIN_ALLOW_ALL = True
+    SERVERSETTINGS.cache_enabled = True
+    INSTALLED_APPS = list(INSTALLED_APPS) + ['corsheaders']
+
+    CORS_ALLOW_METHODS = (
+        'DELETE',
+        'GET',
+        'OPTIONS',
+        'PATCH',
+        'POST',
+        'PUT',
+    )
+    BASIC_USER_ID = 2
+
+    CORS_ALLOW_HEADERS = (
+        'accept',
+        'accept-encoding',
+        'authorization',
+        'content-type',
+        'user-agent',
+        'x-csrftoken',
+        'x-requested-with',
+        'x-token',
+        'Bearer',
+    )
+
+    HOST = "https://wb.sarex.io"
+
+    POSTGRES_DATABASE = os.environ.get('DJANGO_POSTGRES_DATABASE')
+    POSTGRES_USER = os.environ.get('DJANGO_POSTGRES_USER')
+    POSTGRES_PASSWORD = os.environ.get('DJANGO_POSTGRES_PASSWORD')
+    POSTGRES_HOST = os.environ.get('DJANGO_POSTGRES_HOST')
+    POSTGRES_PORTS = os.environ.get('DJANGO_POSTGRES_PORTS', "5432")
+
+    DATABASES = {
+        'default': {
+            'ENGINE': 'django_prometheus.db.backends.postgresql',
+            'NAME': POSTGRES_DATABASE,
+            'USER': POSTGRES_USER,
+            'PASSWORD': POSTGRES_PASSWORD,
+            'HOST': POSTGRES_HOST,
+            'PORT': POSTGRES_PORTS,
+        }
+    }
+
+    LOGGING = {
+        'version': 1,
+        'disable_existing_loggers': False,
+        'filters': {
+            'require_debug_false': {
+                '()': 'django.utils.log.RequireDebugFalse',
+            }
+        },
+        'formatters': {
+            'verbose': {
+                'format': '[contactor] %(levelname)s %(asctime)s %(message)s',
+            },
+        },
+        'handlers': {
+            'console': {
+                'level': 'DEBUG',
+                'class': 'logging.StreamHandler',
+            },
+            'sentry': {
+                'level': 'ERROR',
+                'filters': ['require_debug_false'],
+                'class': 'logging.StreamHandler',
+            },
+        },
+        'loggers': {
+            '': {
+                'handlers': ['console', 'sentry'],
+                'level': 'INFO',
+                'propagate': False,
+            },
+        }
+    }
+
+    COMPARATOR_JWT = os.environ.get("COMPARATOR_JWT", "default_jwt")
+    COMPARATOR_URL = os.environ.get("COMPARATOR_URL", "https://wb.sarex.io/comparator")
+    COMPARATOR_SECTION = os.environ.get("COMPARATOR_SECTION", "sarex-production-storage")
+
+    SIMPLE_JWT = {
+        'ACCESS_TOKEN_LIFETIME': timedelta(hours=1),
+        'REFRESH_TOKEN_LIFETIME': timedelta(days=1),
+        'ROTATE_REFRESH_TOKENS': False,
+        'BLACKLIST_AFTER_ROTATION': True,
+        'UPDATE_LAST_LOGIN': False,
+        'ALGORITHM': 'RS512',
+        'SIGNING_KEY': os.environ.get("JWT_PRIVATE_KEY").replace("\\n", "\n"),
+        'VERIFYING_KEY': os.environ.get("JWT_PUBLIC_KEY").replace("\\n", "\n"),
+        'AUDIENCE': None,
+        'ISSUER': os.environ.get('SIMPLE_JWT_ISSUER', 'default_issuer'),
+        'AUTH_HEADER_TYPES': ('Bearer',),
+        'AUTH_HEADER_NAME': 'HTTP_AUTHORIZATION',
+        'USER_ID_FIELD': 'id',
+        'USER_ID_CLAIM': 'user_id',
+        'AUTH_TOKEN_CLASSES': ('rest_framework_simplejwt.tokens.AccessToken',),
+        'TOKEN_TYPE_CLAIM': 'token_type',
+        'JTI_CLAIM': 'jti',
+        'SLIDING_TOKEN_REFRESH_EXP_CLAIM': 'refresh_exp',
+        'SLIDING_TOKEN_LIFETIME': timedelta(minutes=5),
+        'SLIDING_TOKEN_REFRESH_LIFETIME': timedelta(days=1),
+    }
+
+    os.environ["DJANGO_ALLOW_ASYNC_UNSAFE"] = "true"
+    DEFAULT_FILE_STORAGE = 'sarex.core.storages.CustomS3Boto3Storage'
+    DATA_UPLOAD_MAX_MEMORY_SIZE = 268435456
+
+    if not os.environ.get('ISOLATED', False):
+        import sentry_sdk
+        from sentry_sdk.integrations.django import DjangoIntegration
+
+        sentry_sdk.init(
+            dsn="https://3df2f4b8d3d14595a06c92e9d7c562cb@sentry.io/1501541",
+            integrations=[DjangoIntegration()],
+            environment=os.environ.get('SENTRY_ENVIRONMENT', 'production'),
+            send_default_pii=True,
+        )
+
+    COMPARISON_API_URL = f"{os.environ.get('WORKFLOWSSETTINGS_HOST')}/comparisons"
+    DOCUMENTATION_API_URL = f"{os.environ.get('WORKFLOWSSETTINGS_HOST')}/documentations"
+    PDM_FILES_API_URL = f"{os.environ.get('WORKFLOWSSETTINGS_HOST')}/files"
+
+    WORKFLOWS_TASKS = {
+        "update_orthomosaic_data": {
+            "image": f"{os.environ.get('WORKFLOWSSETTINGS_REGISTRY')}/update-orthomosaic-data:dev",
+            "service_requests": ["django-auth"],
+            "backoff_limit": 3,
+        },
+    }
+
+    REST_FRAMEWORK = {      'DEFAULT_PAGINATION_CLASS': (
+        'rest_framework.pagination.LimitOffsetPagination'      ),
+        'DEFAULT_SCHEMA_CLASS': 'rest_framework.schemas.coreapi.AutoSchema',
+        'PAGE_SIZE': 1000,      'DEFAULT_FILTER_BACKENDS': [
+        'django_filters.rest_framework.DjangoFilterBackend'      ],
+        'DEFAULT_AUTHENTICATION_CLASSES': [
+        'sarex.authentication.backends.ZitadelJWTAuthentication',
+        'rest_framework.authentication.RemoteUserAuthentication',
+        'rest_framework_simplejwt.authentication.JWTAuthentication',
+        'rest_framework.authentication.BasicAuthentication',
+        'rest_framework.authentication.SessionAuthentication',
+        'sarex.authentication.backends.JWTAuthentication'      ],
+        'DEFAULT_PERMISSION_CLASSES': [
+        'rest_framework.permissions.IsAuthenticated',      ]  }
+
+    AUTHENTICATION_BACKENDS = [
+        'sarex.authentication.backends.CustomRemoteUserBackend',
+        'django.contrib.auth.backends.ModelBackend',
+        'guardian.backends.ObjectPermissionBackend',
+    ]
+
+    MIDDLEWARE = [
+        'django_prometheus.middleware.PrometheusBeforeMiddleware',
+        'django.middleware.security.SecurityMiddleware',
+        'django.contrib.sessions.middleware.SessionMiddleware',
+        'django.middleware.common.CommonMiddleware',
+        'django.middleware.csrf.CsrfViewMiddleware',
+        #'django_keycloak.middlewares.AuthorizationHeaderMiddleware',
+        #'django_keycloak.middlewares.KeycloakSessionMiddleware',
+        'django.contrib.auth.middleware.AuthenticationMiddleware',
+        #'django.contrib.auth.middleware.RemoteUserMiddleware',
+        'django.contrib.messages.middleware.MessageMiddleware',
+        'django.middleware.clickjacking.XFrameOptionsMiddleware',
+        'django_user_agents.middleware.UserAgentMiddleware',
+        'simple_history.middleware.HistoryRequestMiddleware',
+        'django_prometheus.middleware.PrometheusAfterMiddleware',  ]
+
+
+    class KeyCloakSettings(BaseSettings):
+        client_id: str = "client_id"
+        client_secret: str = "client_secret"
+        discovery_url: str = "https://login.wb.sarex.io/realms/sarex/.well-known/openid-configuration"
+        staff: Optional[str] = "Sarex staff"
+        superuser: Optional[str] = "Sarex superusers"
+        sync_with_django: bool = True
+        sync_admin: bool = False
+        group_prefix: str = 'Sarex-Role'
+        company_prefix: str = 'Sarex-Company'
+        department_prefix: str = 'Sarex-Department'
+        position_prefix: str = 'Sarex-Position'
+        separator: str = '__'
+        sync_user_groups: bool = False
+        sync_user_positions: bool = False
+        sync_user_departments: bool = False
+        sync_user_companies: bool = False
+        use_redirect_logout: bool = False
+        logout_redirect_uri: str = "/"
+        default_group_name: Optional[str] = 'Тест'
+        default_company_name: Optional[str] = 'Брусника'
+        trusted_uri: List[str] = ['/api/core/orthophotos/', '/api/token', '/api/token/me']
+        trusted_uri: List[str] = []
+
+        class Config:
+            env_prefix = "KC_"
+
+
+    KEYCLOAKSETTINGS = KeyCloakSettings()
+
+    REMOTE_USER_DEFAULT_COMPANY_ID = 1
+    SAREX_MODULES = [
+        {
+            "name": "Замечания",
+            "uri": "/remarks"
+        },
+        {
+          "name": "Управление проектами",
+          "uri": "/management/projects",
+        },
+        {
+            "name": "Замечания V2",
+            "uri": "/issues"
+        },
+        {
+            "name": "Документация",
+            "uri": "/documentations"
+        },
+        {
+            "name": "Согласование документов",
+            "uri": "/reviews"
+        },
+        {
+            "name": "Рабочие процессы",
+            "uri": "/processes"
+        },
+         {
+            "name": "Запросы",
+            "uri": "/rfi"
+        },
+
+        {
+    		      "name": "Аналитика",
+    		      "uri": "/analytics"
+    		  },
+        #  {
+        #     "name": "Обзор",
+        #     "uri": "/projects"
+        # },
+        {
+          "name": "Передача документации",
+          "uri": "/transmittal"
+          },
+    ]
+    AUTH_SETTINGS = {
+      "refresh_token": False,
+      "refresh_token_uri": "/api/token/me",
+      "refresh_oauth_token": True,
+      "refresh_oauth_token_uri": "/oauth/token",
+      "refresh_time": 240,
+    }
+
+
+    DEBUG=False
+    #WEB_APP_AUTH_MODE='jwt-session-based'
+
+
+    SAREX_MODULES_SETTINGS = {
+        "aero": {
+            "enable_new_media": True
+        },
+        "sso_logout_redirect": True
+    }

apps/django/wb/export-project.yaml

@@ -0,0 +1,105 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: export-project
+  namespace: django
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      export-project:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/export-project:prod_ef8aa756
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: export-project
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          resources:
+            limits:
+              cpu:
+                _default: "2"
+              memory:
+                _default: 8Gi
+            requests:
+              cpu:
+                _default: "1"
+              memory:
+                _default: 512Mi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: export-project-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        envs:
+          - name: TIMEOUT
+            value:
+              _default: "180"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/django/wb/frontend.yaml

@@ -0,0 +1,118 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: django
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      frontend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-frontend-dev:contour_5.22.3
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: frontend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: frontend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: nginx-configmap
+              mountPath:
+                _default: /etc/nginx/nginx.conf
+              subPath:
+                _default: nginx.conf
+              configMap:
+                name:
+                  _default: nginx-configmap
+                items:
+                  - key: nginx.conf
+                    path:
+                      _default: nginx.conf
+
+            - name: zitadel-configmap
+              mountPath:
+                _default: /opt/react_client/static/config.json
+              subPath:
+                _default: config.json
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: zitadel-configmap
+                items:
+                  - key: config.json
+                    path:
+                      _default: config.json
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/django/wb/gatekeeper.yaml

@@ -0,0 +1,120 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: gatekeeper
+  namespace: django
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      gatekeeper:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/gatekeeper:2.12.1
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: gatekeeper
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8080
+
+          args:
+            _default:
+              - "--discovery-url=https://keycloak.wildberries.ru/realms/infrastructure/.well-known/openid-configuration"
+              - "--listen=0.0.0.0:8080"
+              - "--enable-logging=true"
+              - "--upstream-url=http://frontend-service.django.svc.cluster.local:80/"
+              - "--enable-refresh-tokens=true"
+              - "--enable-session-cookies=true"
+              - "--verbose"
+              - "--resources=uri=/*"
+              - "--encryption-key=zfDjuszywHSbAhY8KJQbESbpUYN74XTs"
+              - "--secure-cookie=false"
+              - "--cors-origins=*"
+              - "--skip-openid-provider-tls-verify=true"
+              - "--enable-default-deny=false"
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: gatekeeper-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 8080
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        envs:
+          - name: PROXY_REDIRECTION_URL
+            value:
+              _default: "https://lk.srx.wb.ru"
+
+        secretEnvs:
+          - name: PROXY_CLIENT_ID
+            secretName:
+              _default: "gatekeeper-secret"
+            secretKey: "client_id"
+
+          - name: PROXY_CLIENT_SECRET
+            secretName:
+              _default: "gatekeeper-secret"
+            secretKey: "client_secret"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/django/wb/kafka-cert-configmap.yaml

@@ -0,0 +1,38 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kafka-cert
+  namespace: django
+data:
+  kafka.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIIFLTCCAxWgAwIBAgIUYDZPxGRsr7IiqHEmfd07QTQlOKYwDQYJKoZIhvcNAQEN
+    BQAwLTETMBEGA1UECgwKaW8uc3RyaW16aTEWMBQGA1UEAwwNY2x1c3Rlci1jYSB2
+    MDAeFw0yNTEyMTYxNDM0NTVaFw0yNjEyMTYxNDM0NTVaMC0xEzARBgNVBAoMCmlv
+    LnN0cmltemkxFjAUBgNVBAMMDWNsdXN0ZXItY2EgdjAwggIiMA0GCSqGSIb3DQEB
+    AQUAA4ICDwAwggIKAoICAQCfzDZhEzw2pbU5Xpu8OzD+3iQG+DVjU8PQWWQEF27h
+    yjohDkUr3zCZtW7xMKWKUNxBgrKsfe4TDOQN8cij3cS9sy0So+UhMeF7Bq9PU1Yd
+    bmTRq8q1PiuNUkiCGJ5wrb3+NZvVxZLJUIFgiealsRw80MgMWWSzy0I35T2Edn/a
+    DU4jhlgQxyzQ621+oGP0n28gCjmm6pCq2tkj/Z8WTdu1gOWyRdK02a2uE2Ts2nLa
+    Di32GaZrIbIuD/WUd6Ek66uCeJvh2CT7s+SqgtMbtT7gibUuPQ3hk1VGQsjy22l3
+    hUNpLu86nrwbuf21mY55KnLOcaVq1ag1TpIIKfZAL/KWFCGZ6H6kwEIbCAL0Hei7
+    cJ2Wm2/qlzKUeU869M7YybZAfXl/t6XT4QgFgje+42N980vy5A4GhWi1Z7lPqqOe
+    jPGBstkRZybKz1sTk87+oJx82iQU/ozVmzjSEK1SoYRNbvug8PNpxmPoPnJ2flgG
+    t2q2+2ZQP3f1aAHVcZ3U5+hWlRmKPXzjrJv7gnhuvqJl7OwB50y+yWiVfZ9xrYl2
+    EpX+yHuFFK+9NnB5taUK8Fz+hQaLU8J4q7P0bRqkoI+LdcEErjuDT/eI2d5+Ql8K
+    /JkV823hX2WNB9bdaQ24BelVUbsxGpR7ms6KWrM11kHnbzUlEM+AxZES6F7Qbr55
+    TwIDAQABo0UwQzAdBgNVHQ4EFgQUM7hshx7e9TFEN82Pf446aBrJUA4wEgYDVR0T
+    AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQENBQADggIB
+    AFNHFGPDxY966fz0dxDFFSfeo47y7XQZMK9xAwH73cQoSeqx+IMxzgM8nfJQ9XMN
+    PeLwVRZ7pvRee2ZhUPglBSTHnW2rvfmLBOO9xyKZxRsCkoFxuHH9xfM7bFWb96R6
+    fGrOdEZDB3yj00T+tkubwqt+/dUhQUj8juwyPs55WMb/0BIbapaoQ6QOP13CaXDV
+    ZmAfsEEIBkNxfq7GTr/z0Rq0B4+9FxAf3Jrsmi/dYoFD/prHsvBDkYw1daoFyp5C
+    tbctvB9wtphnCCynekt8UBvpVKHUU/xaUa09TQTToXjBbV1SZeIOHNG0MNbWa4sz
+    AL/cpXdq1EAxiTeAVT9XhCwhe/xJvFZIWuFLmW3J+ZxrOUCKieCYpTqBY2tBkkDY
+    //egic787yTR6zxqQNSzvNU5LhzrN7lu+KHGM06T35+HvpzgPPiRCzsxO62p63op
+    mq04K31yYZgLiqeAj5W+rioRGJNn4TXJpH9KIrzmGM7lVWLYWMAKeZU4r1lDUdcu
+    7jsBH8BRJWJeVK3xVw2HB3lk7Xn0WrR92adeYQ3f0vKbMIAVUnSJ3yCKJ4NMFSki
+    j78nx2mi/G0RhUPGZ9hhLXQKj9BtbpEnwpbGWtf0ShtVOxD/HKLCr7koBtW9TMPS
+    9K0sJhE5VjsQLkDDu9p3GdRcuLNA/oa7xFvRFtqGFsLj
+    -----END CERTIFICATE-----

apps/django/wb/kustomization.yaml

@@ -3,21 +3,18 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: django
 resources:
-  - ../base
+  - django-configmap.yaml
-patches:
+  - uwsgi-configmap.yaml
-  - path: backend.yaml
+  - zitadel-configmap.yaml
-    target:
+  - nginx-configmap.yaml
-      kind: HelmRelease
+  - kafka-cert-configmap.yaml
-      name: backend
+  - backend.yaml
-  - path: zitadel-configmap.yaml
+  - celery.yaml
-    target:
+  - export-project.yaml
-      kind: ConfigMap
+  - frontend.yaml
-      name: zitadel-configmap
+  - gatekeeper.yaml
-  - path: s3-proxy.yaml
+  - measurement.yaml
-    target:
+  - redis.yaml
-      kind: HelmRelease
+  - s3-proxy.yaml
-      name: s3-proxy
+  - srx-admin.yaml
-  - path: nginx-configmap.yaml
+  - auth-flow-frontend.yaml
-    target:
-      kind: ConfigMap
-      name: nginx-configmap

apps/django/wb/measurement.yaml

@@ -0,0 +1,112 @@
+---
+# measurement — компонент приложения measurements (apps/measurements),
+# в wb развёрнут в ns django, а не в своём собственном неймспейсе.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: measurement
+  namespace: django
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      measurement:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/measurements:prod_ece72657
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: measurement
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: measurement-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: tmp-volume
+              mountPath:
+                _default: /tmp
+              emptyDir: {}
+
+        envs:
+          - name: DJANGO_HOST
+            value:
+              _default: "https://lk.srx.wb.ru:30443"
+
+          - name: S3_JSON_FILE
+            value:
+              _default: "/opt/cred_s3.json"
+
+        secretEnvs:
+          - name: S3_JSON_SETTINGS
+            secretName:
+              _default: "s3-json-settings"
+            secretKey: "S3_JSON_SETTINGS"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/django/wb/nginx-configmap.yaml

@@ -1,9 +1,4 @@
 ---
-# В base nginx проксирует /workflows/ на frontend-svc.processing — в wb
-# processing развёрнут в ns workflow (apps/processing/wb), поэтому правим
-# proxy_pass. ConfigMap.data — карта с единственным ключом nginx.conf, значит
-# приходится продублировать содержимое целиком (map мержится по ключам, но
-# ключ тут один и это цельная строка).
 apiVersion: v1
 kind: ConfigMap
 metadata:
@@ -68,83 +63,58 @@ data:
                 if_modified_since off;
                 expires off;
             }
-
             location ~^/api/pm/ {
                 #rewrite /api/(.+) /$1 break;
-                proxy_http_version 1.1;
-                proxy_set_header Connection "";
                 proxy_set_header Host $host;
-                proxy_pass http://backend-svc.pm.svc.cluster.local:8000;
+                proxy_pass http://backend-service.pm.svc.cluster.local:8000;
+            }
+
+            location ~^/media/ {
+                rewrite ^/media/(.*)$ /$1 break;
+                proxy_set_header Host $host;
+                proxy_pass http://s3-proxy-service:80;
             }
 
             location ~^/api/v1/documents/ {
-                proxy_http_version 1.1;
                 #rewrite /api/(.+) /$1 break;
                 proxy_set_header Host $host;
-                proxy_pass http://backend-filestream-svc.documentations.svc.cluster.local:80;
+                proxy_pass http://documentations-filestream.documentations.svc.cluster.local:8080;
             }
 
             location ~^/(api|admin)/ {
-                proxy_http_version 1.1;
-                proxy_set_header Connection "";
                 proxy_set_header Host $host;
-                proxy_pass http://backend-svc.django.svc.cluster.local:80;
+                proxy_pass http://backend:8000;
             }
 
+            # location ~^/flows/static/ {
+            #      rewrite /flows/static/(.+) /$1 break;
+            #      proxy_pass http://frontend-service.flows:80;
+            # }
 
-            location = /static/pdf-runtime/assets/mupdf-wasm.wasm {
+            #  location = ~^/orchestrator/ {
-                alias /opt/react_client/static/pdf-runtime/assets/mupdf-wasm.wasm;
+            # rewrite ^/orchestrator$ /api/ break;
-                add_header Content-Type application/wasm always;
+            # proxy_pass http://cde.orchestrator.svc.cluster.local:8080;
-                add_header Cache-Control "public, max-age=31536000, immutable" always;
+            # }
-                add_header Access-Control-Allow-Origin "*" always;
-                add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
-                add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
-            }
 
-            location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.js {
+            # location = ~^/orchestrator/api/process {
-                alias /opt/react_client/static/viewer-pdf/mupdf-wasm.js;
+            #     rewrite ^/orchestrator/api/process$ /api/process break;
-                add_header Content-Type application/javascript always;
+            #     proxy_pass http://cde.orchestrator.svc.cluster.local:8080;
-                add_header Cache-Control "public, max-age=31536000, immutable" always;
+            # }
-                add_header Access-Control-Allow-Origin "*" always;
-                add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
-                add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
-            }
 
-            location = /workspaces-v2/worker/mupdf.worker-3.3.9.js {
+            # location ~ ^/orchestrator/api/process/(.*)$ {
-                alias /opt/react_client/static/pdf-runtime/mupdf.worker-3.3.9.js;
+            #     rewrite ^/orchestrator/api/process/(.*)$ /api/process/$1 break;
-                add_header Content-Type application/javascript always;
+            #     proxy_pass http://cde.orchestrator.svc.cluster.local:8080;
-                add_header Cache-Control "public, max-age=31536000, immutable" always;
+            # }
-                add_header Access-Control-Allow-Origin "*" always;
-                add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
-                add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
-            }
 
-            location = /workspaces-v2/worker/static/viewer-pdf/mupdf.js {
+            # location = ~^/orchestrator/api/sign {
-                alias /opt/react_client/static/viewer-pdf/mupdf.js;
+            #     rewrite ^/orchestrator/api/sign$ /api/sign break;
-                add_header Content-Type application/javascript always;
+            #     proxy_pass http://cde.orchestrator.svc.cluster.local:8080;
-                add_header Cache-Control "public, max-age=31536000, immutable" always;
+            # }
-                add_header Access-Control-Allow-Origin "*" always;
-                add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
-                add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
-            }
 
-            location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.wasm {
-                add_header Content-Type application/wasm always;
-                alias /opt/react_client/static/viewer-pdf/mupdf-wasm.wasm;
-            }
 
             location ~^/workspaces-v2/(.+).js {
-                proxy_http_version 1.1;
-                proxy_set_header Connection "";
                 rewrite /workspaces-v2/(.+) /$1 break;
-                proxy_pass http://frontend-svc.workspaces.svc.cluster.local:80;
+                proxy_pass http://workspaces-v2-frontend-static-service.workspaces.svc.cluster.local:8080;
-            }
-
-            location ~^/workspaces-v2/(.+)\.wasm$ {
-                proxy_http_version 1.1;
-                proxy_set_header Connection "";
-                rewrite ^/workspaces-v2/(.+) /$1 break;
-                proxy_pass http://frontend-svc.workspaces.svc.cluster.local:80;
             }
 
             location @index {
@@ -155,10 +125,8 @@ data:
             }
 
             location ~^/workflows/(.+).js {
-                proxy_http_version 1.1;
-                proxy_set_header Connection "";
                  rewrite /workflows/(.+) /$1 break;
-                proxy_pass http://frontend-svc.workflow.svc.cluster.local:80;
+                 proxy_pass http://frontend-service.workflow.svc.cluster.local:8080;
             }
             location /service-worker.js {
                 try_files /static/$uri @index;

apps/django/wb/redis.yaml

@@ -0,0 +1,88 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: redis
+  namespace: django
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      redis:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/redis:latest
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: redis
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 6379
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: redis-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 6379
+
+          targetPort:
+            _default: 6379
+
+          portName:
+            _default: tcp
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/django/wb/s3-proxy.yaml

@@ -1,26 +1,117 @@
 ---
-# Патч s3-proxy для контура wb.
-#
-# В base зашит AWS_API_ENDPOINT=https://minio.contour.infra.sarex.tech —
-# недоступен в wb. Эндпоинт задан литералом, а не через .Data.data.client.endpoint,
-# так же как в apps/django/wb/backend.yaml для того же секрета
-# secrets/data/minio/apps/django — держим один способ на весь ns.
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
   name: s3-proxy
   namespace: django
+
 spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
   values:
+    global:
+      env: _default
+
     services:
       s3-proxy:
-        podAnnotations:
+        enabled: true
-          _default:
+
-            vault.hashicorp.com/agent-inject-template-s3: |
+        image:
-              {{- with secret "secrets/data/minio/apps/django" }}
+          name:
-              AWS_API_ENDPOINT=http://10.49.10.90:9000
+            _default: cr.yandex/crp3ccidau046kdj8g9q/s3-proxy:stable
-              {{- $buckets := index .Data.data "buckets" }}
+          pullPolicy:
-              AWS_S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }}
+            _default: IfNotPresent
-              AWS_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
+
-              AWS_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
+        deployment:
-              {{- end }}
+          enabled: true
+
+          name:
+            _default: s3-proxy
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: s3-proxy-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        envs:
+          - name: AWS_API_ENDPOINT
+            value:
+              _default: "http://10.49.10.90:9000"
+
+          - name: ACCESS_LOG
+            value:
+              _default: "true"
+
+          - name: CORS_ALLOW_HEADERS
+            value:
+              _default: "Content-Type, Accept-Ranges, Content-Range, Content-Encoding"
+
+        secretEnvs:
+          - name: AWS_ACCESS_KEY_ID
+            secretName:
+              _default: "sarex-media-storage-secret"
+            secretKey: "login"
+
+          - name: AWS_SECRET_ACCESS_KEY
+            secretName:
+              _default: "sarex-media-storage-secret"
+            secretKey: "password"
+
+          - name: AWS_S3_BUCKET
+            secretName:
+              _default: "sarex-media-storage-secret"
+            secretKey: "bucket"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/django/wb/srx-admin.yaml

@@ -0,0 +1,95 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: srx-admin
+  namespace: django
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      srx-admin:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/srx-admin:prod_c73e9855
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: srx-admin
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: srx-admin-svc
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8080
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: tmp-volume
+              mountPath:
+                _default: /tmp
+              emptyDir: {}
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/django/wb/uwsgi-configmap.yaml

@@ -0,0 +1,31 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: uwsgi-configmap
+  namespace: django
+data:
+  uwsgi.ini: |
+    [uwsgi]
+    module                 = config.wsgi:application
+    DJANGO_SETTINGS_MODULE = config.settings.production
+    http                   = 0.0.0.0:8000
+    processes              = 16
+    master                 = true
+    vacuum                 = true
+    enable-threads         = true
+    buffer-size            = 65535
+    stats                  = :3031
+    stats-http             = true
+    memory-report          = true
+    lazy-apps              = true
+    listen                 = 128
+    disable-write-exception= 0
+    harakiri               = 300
+    socket-timeout         = 300
+    chunked-input-timeout  = 300
+    http-timeout           = 300
+    worker-reload-mercy    = 240
+    mule-reload-mercy      = 240
+    static-map = /static=/opt/sarex/sarex/static/
+    static-map = /media=/media/

apps/django/wb/zitadel-configmap.yaml

@@ -1,19 +1,15 @@
 ---
-# Хост Zitadel для wb — zitadel-srx.wb.ru (подтверждено).
-# client_id пока оставлен от base (тестовый контур) — это ID OAuth-клиента,
-# зарегистрированного в конкретном Zitadel-инстансе, его нужно завести/уточнить
-# отдельно для zitadel-srx.wb.ru перед реальным включением django на wb.
 apiVersion: v1
 kind: ConfigMap
 metadata:
   name: zitadel-configmap
   namespace: django
 data:
-  config.json: |
+  config.json: |-
     {
       "auth_type": "zitadel",
       "zitadel": {
-        "client_id": "379557107642492501",
+        "client_id": "363741990556356237",
         "host": "https://zitadel-srx.wb.ru"
       }
     }

apps/documentations/wb/api.yaml

@@ -1,170 +1,335 @@
 ---
-# Патч documentations-api для контура wb.
-#
-# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
-# поэтому здесь продублирован весь набор из apps/documentations/base/api.yaml.
-#
-# В base WORKSPACE_V2_EXTERNAL_URL и FILE_STREAM_HOST почему-то остались на
-# тестовом контуре contour.infra.sarex.tech, хотя соседний
-# apps/documentations/base/filestream.yaml для тех же полей уже использует
-# srx.wb.ru — берём то же значение (рассинхрон между api.yaml и
-# filestream.yaml в base, не имеет отношения к ugmk-патчам).
-# WORKFLOW_URL в base смотрит на ns processing — в wb processing развёрнут
-# в ns workflow (apps/processing/wb), тоже поправлено.
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
   name: documentations-api
   namespace: documentations
+
 spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
   values:
+    global:
+      env: _default
+
     services:
-      backend:
+      documentations-api:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_a9990430
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: documentations-api
+
+          replicaCount:
+            _default: 3
+
+          port:
+            _default: 8080
+
+          resources:
+            requests:
+              cpu:
+                _default: 300m
+              memory:
+                _default: 300Mi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: documentations-api
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8080
+
+          targetPort:
+            _default: 8080
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: documentations-yc-s3-secret
+              mountPath:
+                _default: /etc/sarex/yc-s3-storage
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: documentations-yc-s3
+
+            - name: zitadel-account
+              mountPath:
+                _default: /etc/sarex/zitadel
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: zitadel-account
+
         envs:
+          - name: POSTGRES_ADDRESS
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: POSTGRES_PORT
+            value:
+              _default: "5432"
+
+          - name: POSTGRES_DB
+            value:
+              _default: "documentations_db"
+
           - name: POSTGRES_POOL_SIZE
             value:
               _default: "20"
-          - name: USE_LEGACY_BIM_FLOW
+
-            value:
-              _default: "true"
           - name: ZITADEL_ACCOUNT
             value:
-              _default: /vault/secrets/documentations-zitadel-account-json
+              _default: "/etc/sarex/zitadel/zitadel-account.json"
+
           - name: ZITADEL_DOMAIN
             value:
-              _default: zitadel-srx.wb.ru
+              _default: "zitadel-srx.wb.ru"
+
           - name: USE_ZITADEL
             value:
               _default: "1"
+
           - name: FLOWS_URL
             value:
-              _default: http://backend-svc.flows.svc.cluster.local:80
+              _default: "http://backend-service.flows.svc.cluster.local:8000"
+
           - name: LAST_MASTER_BIM
             value:
               _default: "36311"
+
           - name: API_ADDRESS
             value:
-              _default: 0.0.0.0:8080
+              _default: "0.0.0.0:8080"
+
           - name: API_ADDRESS_FILE
             value:
-              _default: 0.0.0.0:8080
+              _default: "0.0.0.0:8080"
+
           - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES
             value:
               _default: "5"
+
           - name: ENABLE_SQL_QUERY
             value:
               _default: "0"
+
           - name: ENABLE_SSL
             value:
               _default: "0"
+
           - name: WORKSPACE_V2_EXTERNAL_URL
             value:
-              _default: https://srx.wb.ru/workspaces-v2/
+              _default: "https://srx.wb.ru/workspaces-v2/"
+
           - name: ENABLE_S3
             value:
               _default: "1"
+
           - name: CONTAINER_REGISTRY
             value:
-              _default: cr.yandex/crp3ccidau046kdj8g9q
+              _default: "cr.yandex/crp3ccidau046kdj8g9q"
+
           - name: ENVIRONMENT
             value:
-              _default: production
+              _default: "production"
+
           - name: LAST_SLAVE_1_BIM
             value:
               _default: "1000000"
+
           - name: HOST
             value:
-              _default: http://backend-api-svc.documentations.svc.cluster.local:80
+              _default: "http://documentations-api.documentations.svc.cluster.local:8080"
+
           - name: FILE_STREAM_HOST
             value:
-              _default: srx.wb.ru
+              _default: "srx.wb.ru"
+
           - name: DOCUMENTATION_URL
             value:
-              _default: http://backend-api-svc.documentations.svc.cluster.local:80/
+              _default: "http://documentations-api.documentations.svc.cluster.local:8080/"
+
           - name: WORKFLOW_URL
             value:
-              _default: http://backend-svc.workflow.svc.cluster.local:80/
+              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000/"
+
           - name: WORKSPACE_URL
             value:
-              _default: http://backend-svc.workspaces.svc.cluster.local:80/
+              _default: "http://workspaces-service.workspaces.svc.cluster.local:8000/"
+
           - name: BIM_API_URL
             value:
-              _default: http://backend-svc.bim.svc.cluster.local:80/
+              _default: "http://bim-api-service.bim.svc.cluster.local:8080/"
+
           - name: BIM_API_V2_URL
             value:
-              _default: http://backend-svc.bim.svc.cluster.local:80/
+              _default: "http://backend-service.bim.svc.cluster.local:8000/"
+
           - name: WORKSPACE_BUNDLE_VERSION
             value:
-              _default: v1
+              _default: "v1"
+
           - name: SYSTEM_LOG_URL
             value:
-              _default: http://backend-svc.system-log.svc.cluster.local:80
+              _default: "http://api-service.system-log.svc.cluster.local:8000"
+
           - name: DJANGO_HOST
             value:
-              _default: http://backend-svc.django.svc.cluster.local:80
+              _default: "http://backend.django.svc.cluster.local:8000"
+
           - name: MARKS_PROCESSING_URL
             value:
-              _default: http://marks-service:8000
+              _default: "http://marks-service:8000"
-          - name: USE_MARKS_RABBITMQ
+
-            value:
-              _default: "true"
-          - name: MARKS_RABBITMQ_HOST
-            value:
-              _default: rabbitmq.rabbitmq.svc.cluster.local
-          - name: MARKS_RABBITMQ_PORT
-            value:
-              _default: "5672"
           - name: PUBLIC_LINK_HOST
             value:
-              _default: https://document-link-srx.wb.ru
+              _default: "https://document-link-srx.wb.ru"
+
           - name: NAMESPACE
             value:
-              _default: documentations
+              _default: "documentations"
+
           - name: DJANGO_ORIGINATOR
             value:
-              _default: docs_prod
+              _default: "docs_prod"
+
           - name: WORKFLOW_IMAGES_VERSION
             value:
-              _default: master
+              _default: "master"
+
           - name: WORKFLOWS_IMAGES_VERSION
             value:
-              _default: master
+              _default: "master"
+
           - name: S3_SERVICE_ACCOUNT
             value:
-              _default: /vault/secrets/documentations-s3-account-json
+              _default: "/etc/sarex/yc-s3-storage/yc-s3-service-account.json"
+
           - name: READ_WRITE_TIMEOUT_FILE_STREAM
             value:
-              _default: 6h
+              _default: "6h"
+
           - name: CACHE_DEFAULT_EXPIRATION
             value:
-              _default: 60s
+              _default: "60s"
+
           - name: ENABLE_SMTP
             value:
               _default: "True"
+
           - name: ENABLE_MAILGUN
             value:
               _default: "False"
+
           - name: CACHE_CLEANUP_INTERVAL
             value:
-              _default: 60s
+              _default: "60s"
-          - name: DOCUMENT_PUBLIC_LINK_JWT_SECRET
+
-            value:
-              _default: "mock"
           - name: ENABLE_AUTH_JWT_IN_URL
             value:
-              _default: "true"
+              _default: "false"
+
           - name: ENABLE_SIGNATURE_IN_URL
             value:
-              _default: "false"
+              _default: "true"
+
           - name: USE_CACHE_IN_FILE_STREAMER
             value:
-              _default: "0"
+              _default: "1"
+
           - name: VALKEY_ADDR
             value:
-              _default: redis:6379
+              _default: "redis:6379"
+
           - name: VALKEY_HOST
             value:
-              _default: redis
+              _default: "redis"
+
           - name: VALKEY_PORT
             value:
               _default: "6379"
+
+        secretEnvs:
+          - name: PUBLIC_KEY
+            secretName:
+              _default: "public-key"
+            secretKey: "key"
+
+          - name: DOCUMENT_PUBLIC_LINK_JWT_SECRET
+            secretName:
+              _default: "yc-jwt-secret"
+            secretKey: "secret"
+
+          - name: POSTGRES_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: POSTGRES_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: DJANGO_BASIC_AUTH
+            secretName:
+              _default: "django-auth"
+            secretKey: "key"
+
+          - name: DJANGO_BASIC_AUTH_FOR_GET_USER
+            secretName:
+              _default: "django-auth"
+            secretKey: "key"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/documentations/wb/filestream.yaml

@@ -0,0 +1,292 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: documentations-filestream
+  namespace: documentations
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      documentations-filestream:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:prod_a9990430
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: documentations-filestream
+
+          replicaCount:
+            _default: 3
+
+          port:
+            _default: 8080
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: documentations-filestream
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8080
+
+          targetPort:
+            _default: 8080
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: documentations-yc-s3-secret
+              mountPath:
+                _default: /etc/sarex/yc-s3-storage
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: documentations-yc-s3
+
+            - name: zitadel-account
+              mountPath:
+                _default: /etc/sarex/zitadel
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: zitadel-account
+
+        envs:
+          - name: POSTGRES_ADDRESS
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: POSTGRES_PORT
+            value:
+              _default: "5432"
+
+          - name: POSTGRES_DB
+            value:
+              _default: "documentations_db"
+
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "20"
+
+          - name: API_ADDRESS
+            value:
+              _default: "0.0.0.0:8080"
+
+          - name: API_ADDRESS_FILE
+            value:
+              _default: "0.0.0.0:8080"
+
+          - name: ENABLE_SQL_QUERY
+            value:
+              _default: "0"
+
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+
+          - name: ENABLE_S3
+            value:
+              _default: "1"
+
+          - name: ZITADEL_ACCOUNT
+            value:
+              _default: "/etc/sarex/zitadel/zitadel-account.json"
+
+          - name: ZITADEL_DOMAIN
+            value:
+              _default: "zitadel-srx.wb.ru"
+
+          - name: USE_ZITADEL
+            value:
+              _default: "1"
+
+          - name: CONTAINER_REGISTRY
+            value:
+              _default: "cr.yandex/crp3ccidau046kdj8g9q"
+
+          - name: ENVIRONMENT
+            value:
+              _default: "production"
+
+          - name: HOST
+            value:
+              _default: "http://documentations-service.documentations.svc.cluster.local:8080"
+
+          - name: FILE_STREAM_HOST
+            value:
+              _default: "srx.wb.ru"
+
+          - name: DOCUMENTATION_URL
+            value:
+              _default: "http://documentations-service.documentations.svc.cluster.local:8080/"
+
+          - name: WORKFLOW_URL
+            value:
+              _default: "http://workflows-service.workflow.svc.cluster.local:8000/"
+
+          - name: WORKSPACE_URL
+            value:
+              _default: "http://workspaces-service.workspaces.svc.cluster.local:8000/"
+
+          - name: BIM_API_URL
+            value:
+              _default: "http://bim-api-service.bim.svc.cluster.local:8080/"
+
+          - name: BIM_API_V2_URL
+            value:
+              _default: "http://backend-service.bim.svc.cluster.local:8000/"
+
+          - name: ENABLE_AUTH_JWT_IN_URL
+            value:
+              _default: "false"
+
+          - name: ENABLE_SIGNATURE_IN_URL
+            value:
+              _default: "true"
+
+          - name: WORKSPACE_BUNDLE_VERSION
+            value:
+              _default: "v1"
+
+          - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES
+            value:
+              _default: "5"
+
+          - name: DJANGO_HOST
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+          - name: NAMESPACE
+            value:
+              _default: "sarex-documentations"
+
+          - name: DJANGO_ORIGINATOR
+            value:
+              _default: "docs_prod"
+
+          - name: WORKFLOW_IMAGES_VERSION
+            value:
+              _default: "master"
+
+          - name: WORKFLOWS_IMAGES_VERSION
+            value:
+              _default: "master"
+
+          - name: S3_SERVICE_ACCOUNT
+            value:
+              _default: "/etc/sarex/yc-s3-storage/yc-s3-service-account.json"
+
+          - name: READ_WRITE_TIMEOUT_FILE_STREAM
+            value:
+              _default: "6h"
+
+          - name: CACHE_DEFAULT_EXPIRATION
+            value:
+              _default: "60s"
+
+          - name: CACHE_CLEANUP_INTERVAL
+            value:
+              _default: "60s"
+
+          - name: USE_CACHE_IN_FILE_STREAMER
+            value:
+              _default: "1"
+
+          - name: VALKEY_ADDR
+            value:
+              _default: "redis:6379"
+
+          - name: VALKEY_HOST
+            value:
+              _default: "redis"
+
+          - name: VALKEY_PORT
+            value:
+              _default: "6379"
+
+        secretEnvs:
+          - name: DJANGO_BASIC_AUTH_FOR_GET_USER
+            secretName:
+              _default: "django-auth"
+            secretKey: "key"
+
+          - name: DOCUMENT_PUBLIC_LINK_JWT_SECRET
+            secretName:
+              _default: "yc-jwt-secret"
+            secretKey: "secret"
+
+          - name: POSTGRES_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: POSTGRES_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: DJANGO_BASIC_AUTH
+            secretName:
+              _default: "django-auth"
+            secretKey: "key"
+
+          - name: PUBLIC_KEY
+            secretName:
+              _default: "public-key"
+            secretKey: "key"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/documentations/wb/frontend-public-link.yaml

@@ -0,0 +1,113 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend-public-link
+  namespace: documentations
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      frontend-public-link:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/document-link-frontend:wb_cb2027ce
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: frontend-public-link
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 3000
+
+          command:
+            _default: ["npm", "start"]
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: frontend-service-public-link
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 3000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: envfile
+              mountPath:
+                _default: /app/.env.local
+              subPath:
+                _default: .env.local
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: documentations-publiclink-jwt-secret
+                items:
+                  - key: .env
+                    path:
+                      _default: .env.local
+
+        envs:
+          - name: NODE_ENV
+            value:
+              _default: "production"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/documentations/wb/frontend-static.yaml

@@ -0,0 +1,88 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: documentation-frontend-static
+  namespace: documentations
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      documentation-frontend-static:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentation-frontend-app:brusnika_ce5555d3
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: documentation-frontend-static
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: documentation-frontend-static-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/documentations/wb/kustomization.yaml

@@ -3,13 +3,12 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: documentations
 resources:
-  - ../base
+  - api.yaml
-patches:
+  - filestream.yaml
-  - path: api.yaml
+  - pdm-api.yaml
-    target:
+  - pdf-markings.yaml
-      kind: HelmRelease
+  - pdf-markings-amqp.yaml
-      name: documentations-api
+  - frontend-public-link.yaml
-  - path: pdm.yaml
+  - frontend-static.yaml
-    target:
+  - redis.yaml
-      kind: HelmRelease
+  - stamp-verification.yaml
-      name: pdm-api

apps/documentations/wb/pdf-markings-amqp.yaml

@@ -0,0 +1,193 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: pdf-markings-amqp
+  namespace: documentations
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      api:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_3ab263be
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: pdf-markings-amqp
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: false
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: yc-s3
+              mountPath:
+                _default: /etc/sarex/yc-s3-storage
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: yc-s3
+
+        envs:
+          - name: MARKS_APP__LOG_LEVEL
+            value:
+              _default: "INFO"
+
+          - name: MARKS_CRYPTO__HASHING_ALGO
+            value:
+              _default: "md_gost12_256"
+
+          - name: MARKS_DOCUMENTS_DB__HOST
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: MARKS_DOCUMENTS_DB__PORT
+            value:
+              _default: "5432"
+
+          - name: MARKS_DOCUMENTS_DB__DATABASE
+            value:
+              _default: "documentations_db"
+
+          - name: MARKS_DOCUMENTS_DB__SSLMODE
+            value:
+              _default: "disable"
+
+          - name: MARKS_QR__REDIRECT_URL
+            value:
+              _default: "https://stamp-verification-srx.wb.ru/"
+
+          - name: MARKS_QR__BASE_DOCUMENT_URL
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: MARKS_S3__USE_SSL
+            value:
+              _default: "false"
+
+          - name: MARKS_S3__SSL_VERIFY
+            value:
+              _default: "false"
+
+          - name: MARKS_S3__REGION
+            value:
+              _default: "ru-central1"
+
+          - name: MARKS_S3__DEFAULT_BUCKET
+            value:
+              _default: "documentations-stage-1-sarex-new"
+
+          - name: MARKS_RABBITMQ__ROUTING__INPUT_QUEUE
+            value:
+              _default: "pdf_markings_input"
+
+        secretEnvs:
+          - name: MARKS_DOCUMENTS_DB__USERNAME
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: MARKS_DOCUMENTS_DB__PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: MARKS_S3__URL
+            secretName:
+              _default: "yc-s3"
+            secretKey: "endpoint_url"
+
+          - name: MARKS_S3__ACCESS_KEY
+            secretName:
+              _default: "yc-s3"
+            secretKey: "key_id"
+
+          - name: MARKS_S3__SECRET_KEY
+            secretName:
+              _default: "yc-s3"
+            secretKey: "access_key"
+
+          - name: MARKS_RABBITMQ__HOST
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "host"
+
+          - name: MARKS_RABBITMQ__PORT
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "port"
+
+          - name: MARKS_RABBITMQ__USERNAME
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "username"
+
+          - name: MARKS_RABBITMQ__PASSWORD
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "password"
+
+          - name: MARKS_RABBITMQ__VHOST
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "vhost"
+
+          - name: MARKS_RABBITMQ__HEARTBEAT_SECONDS
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "heartbeat"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/documentations/wb/pdf-markings.yaml

@@ -0,0 +1,231 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: pdf-markings
+  namespace: documentations
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      pdf-markings:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings:prod_7d892636
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: pdf-markings
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          resources:
+            requests:
+              cpu:
+                _default: "2"
+              memory:
+                _default: 8Gi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: marks-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: yc-s3
+              mountPath:
+                _default: /etc/sarex/yc-s3-storage
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: documentations-yc-s3
+
+        envs:
+          - name: APP_NAME
+            value:
+              _default: "pdm_v2"
+
+          - name: VERIFY
+            value:
+              _default: "False"
+
+          - name: APP_VERSION
+            value:
+              _default: "0.0.1"
+
+          - name: LOG_LEVEL
+            value:
+              _default: "INFO"
+
+          - name: HTTP_PORT
+            value:
+              _default: "8000"
+
+          - name: DOC_POSTGRES_HOST
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: DOC_POSTGRES_PORT
+            value:
+              _default: "5432"
+
+          - name: DOC_POSTGRES_DB
+            value:
+              _default: "documentations_db"
+
+          - name: DOC_POSTGRES_POOL_SIZE
+            value:
+              _default: "10"
+
+          - name: DOC_POSTGRES_SSL_MODE
+            value:
+              _default: "disable"
+
+          - name: API_ADDRESS
+            value:
+              _default: "0.0.0.0:8000"
+
+          - name: DATABASE_SSL_MODE
+            value:
+              _default: "disable"
+
+          - name: YANDEX_S3_USE_SSL
+            value:
+              _default: "0"
+
+          - name: ENVIRONMENT
+            value:
+              _default: "production"
+
+          - name: YANDEX_S3_ACCOUNT_PATH
+            value:
+              _default: "/etc/sarex/yc-s3-storage/yc-s3-service-account.json"
+
+          - name: REDIRECT_URL_QR
+            value:
+              _default: "https://stamp-verification-srx.wb.ru/"
+
+          - name: BASE_DOCUMENT_URL
+            value:
+              _default: "https://srx.wb.ru"
+
+        secretEnvs:
+          - name: DOC_POSTGRES_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: DOC_POSTGRES_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: YANDEX_S3_ENDPOINT_URL
+            secretName:
+              _default: "yc-s3"
+            secretKey: "endpoint_url"
+
+          - name: YANDEX_S3_SECRET_ACCESS_KEY
+            secretName:
+              _default: "yc-s3"
+            secretKey: "access_key"
+
+          - name: YANDEX_S3_ACCESS_KEY_ID
+            secretName:
+              _default: "yc-s3"
+            secretKey: "key_id"
+
+          - name: RABBITMQ_HOST
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "host"
+
+          - name: RABBITMQ_PORT
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "port"
+
+          - name: RABBITMQ_USERNAME
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "username"
+
+          - name: RABBITMQ_PASSWORD
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "password"
+
+          - name: RABBITMQ_VHOST
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "vhost"
+
+          - name: RABBITMQ_HEARTBEAT
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "heartbeat"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/documentations/wb/pdm-api.yaml

@@ -0,0 +1,342 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: pdm-api
+  namespace: documentations
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      pdm-api:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/pdmv2:prod_38958427
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: pdm-api
+
+          replicaCount:
+            _default: 3
+
+          port:
+            _default: 8080
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: pdm-api
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8080
+
+          targetPort:
+            _default: 8080
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: documentations-yc-s3-secret
+              mountPath:
+                _default: /etc/sarex/yc-s3-storage
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: documentations-yc-s3
+
+        envs:
+          - name: USE_EXPERIMENTAL
+            value:
+              _default: "true"
+
+          - name: API_ADDRESS
+            value:
+              _default: "0.0.0.0:8080"
+
+          - name: API_ADDRESS_FILE
+            value:
+              _default: "0.0.0.0:8080"
+
+          - name: BUCKET_NAME
+            value:
+              _default: "attachments-storage"
+
+          - name: API_HOST_PREFIX
+            value:
+              _default: "/"
+
+          - name: APP_NAME
+            value:
+              _default: "pdm_v2"
+
+          - name: APP_VERSION
+            value:
+              _default: "0.0.1"
+
+          - name: ENABLE_PERMISSIONS_FILTER
+            value:
+              _default: "1"
+
+          - name: PERMISSIONS_FILTER_COMPANIES
+            value:
+              _default: "[1]"
+
+          - name: TRANSMITTALS_ENABLE
+            value:
+              _default: "false"
+
+          - name: DRAWINGS_INTERNAL_URL
+            value:
+              _default: "http://drawings-api-service.drawings.svc.cluster.local:80"
+
+          - name: ATTACHMENTS_URL
+            value:
+              _default: "http://attachments-service.attachments.svc.cluster.local:8000"
+
+          - name: BIM_API_V2_URL
+            value:
+              _default: "http://backend-service.bim.svc.cluster.local:8000/"
+
+          - name: BIM_V2_HOST
+            value:
+              _default: "http://backend-service.bim.svc.cluster.local:8000/"
+
+          - name: CACHE_CLEANUP_INTERVAL
+            value:
+              _default: "60s"
+
+          - name: CACHE_DEFAULT_EXPIRATION
+            value:
+              _default: "60s"
+
+          - name: DJANGO_HOST
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+          - name: DJANGO_ORIGINATOR
+            value:
+              _default: "docs_prod"
+
+          - name: DOCUMENTATION_URL
+            value:
+              _default: "http://documentations-api.documentations.svc.cluster.local:8080/"
+
+          - name: EAV_URL
+            value:
+              _default: "http://eav-service.eav.svc.cluster.local:8000"
+
+          - name: ENABLE_OBSERVABILITY
+            value:
+              _default: "false"
+
+          - name: ENABLE_S3
+            value:
+              _default: "1"
+
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+
+          - name: ENVIRONMENT
+            value:
+              _default: "prod"
+
+          - name: FLOWS_URL
+            value:
+              _default: "http://backend-service.flows.svc.cluster.local:8000"
+
+          - name: HEIGHT_THUMB_ATTACHMENTS
+            value:
+              _default: "300"
+
+          - name: HEIGHT_THUMB_STATES
+            value:
+              _default: "73"
+
+          - name: HTTP_PORT
+            value:
+              _default: "8080"
+
+          - name: INSPECTIONS_URL
+            value:
+              _default: "http://inspections-service.inspections.svc.cluster.local:80"
+
+          - name: LOG_LEVEL
+            value:
+              _default: "INFO"
+
+          - name: OBSERVABILITY_COLLECTOR_ENDPOINT
+            value:
+              _default: "temp"
+
+          - name: POSTGRES_ADDRESS
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: POSTGRES_DB
+            value:
+              _default: "documentations_db"
+
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "20"
+
+          - name: TRANSMITTALS_BASE_URL
+            value:
+              _default: "mock"
+
+          - name: POSTGRES_PORT
+            value:
+              _default: "5432"
+
+          - name: READ_WRITE_TIMEOUT_FILE_STREAM
+            value:
+              _default: "6h"
+
+          - name: RELEASES_URL
+            value:
+              _default: "https://gitlab.com"
+
+          - name: REMARKS_URL
+            value:
+              _default: "http://remarks-static-service.remarks.svc.cluster.local:8080/remarks"
+
+          - name: RESOURCES_URL
+            value:
+              _default: "http://resources-service.resources.svc.cluster.local:8000"
+
+          - name: S3_SERVICE_ACCOUNT
+            value:
+              _default: "/etc/sarex/yc-s3-storage/yc-s3-service-account.json"
+
+          - name: STATES_URL
+            value:
+              _default: "http://workspaces-service.workspaces.svc.cluster.local:8000/"
+
+          - name: SUBSCRIPTIONS_URL
+            value:
+              _default: "http://sarex-subscriptions-service.subscriptions.svc.cluster.local:80"
+
+          - name: SYSTEM_LOG_URL
+            value:
+              _default: "http://api-service.system-log.svc.cluster.local:8000"
+
+          - name: TARGET_URL
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+          - name: USE_CACHE_IN_FILE_STREAMER
+            value:
+              _default: "1"
+
+          - name: USE_SUBSCRIPTIONS
+            value:
+              _default: "false"
+
+          - name: WIDTH_THUMB_ATTACHMENTS
+            value:
+              _default: "300"
+
+          - name: WIDTH_THUMB_STATES
+            value:
+              _default: "120"
+
+          - name: WORKFLOWS_IMAGES_VERSION
+            value:
+              _default: "master"
+
+          - name: WORKFLOW_IMAGES_VERSION
+            value:
+              _default: "master"
+
+          - name: WORKFLOW_URL
+            value:
+              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000/"
+
+          - name: WORKSPACE_BUNDLE_VERSION
+            value:
+              _default: "v1"
+
+          - name: WORKSPACE_URL
+            value:
+              _default: "http://workspaces-service.workspaces.svc.cluster.local:8000/"
+
+        secretEnvs:
+          - name: RELEASES_TOKEN
+            secretName:
+              _default: "releases-token"
+            secretKey: "key"
+
+          - name: POSTGRES_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: POSTGRES_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: DJANGO_BASIC_AUTH
+            secretName:
+              _default: "django-auth"
+            secretKey: "key"
+
+          - name: PUBLIC_KEY
+            secretName:
+              _default: "public-key"
+            secretKey: "key"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/documentations/wb/pdm.yaml

@@ -1,176 +0,0 @@
----
-# Патч pdm-api для контура wb.
-#
-# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
-# поэтому здесь продублирован весь набор из apps/documentations/base/pdm.yaml.
-# Единственное изменение — WORKFLOW_URL: в base смотрит на ns processing,
-# в wb processing развёрнут в ns workflow (apps/processing/wb).
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: pdm-api
-  namespace: documentations
-spec:
-  values:
-    services:
-      backend:
-        envs:
-          - name: USE_EXPERIMENTAL
-            value:
-              _default: "true"
-          - name: POSTGRES_POOL_SIZE
-            value:
-              _default: "20"
-          - name: TRANSMITTALS_BASE_URL
-            value:
-              _default: mock
-          - name: API_ADDRESS
-            value:
-              _default: 0.0.0.0:8080
-          - name: API_ADDRESS_FILE
-            value:
-              _default: 0.0.0.0:8080
-          - name: BUCKET_NAME
-            value:
-              _default: attachments-storage
-          - name: API_HOST_PREFIX
-            value:
-              _default: /
-          - name: APP_NAME
-            value:
-              _default: pdm_v2
-          - name: APP_VERSION
-            value:
-              _default: "0.0.1"
-          - name: ENABLE_PERMISSIONS_FILTER
-            value:
-              _default: "1"
-          - name: PERMISSIONS_FILTER_COMPANIES
-            value:
-              _default: "[1]"
-          - name: TRANSMITTALS_ENABLE
-            value:
-              _default: "false"
-          - name: DRAWINGS_INTERNAL_URL
-            value:
-              _default: http://drawings-api-service.drawings.svc.cluster.local:80
-          - name: ATTACHMENTS_URL
-            value:
-              _default: http://attachments-service.attachments.svc.cluster.local:8000
-          - name: BIM_API_V2_URL
-            value:
-              _default: http://backend-svc.bim.svc.cluster.local:80/
-          - name: BIM_V2_HOST
-            value:
-              _default: http://backend-svc.bim.svc.cluster.local:80/
-          - name: CACHE_CLEANUP_INTERVAL
-            value:
-              _default: 60s
-          - name: CACHE_DEFAULT_EXPIRATION
-            value:
-              _default: 60s
-          - name: DJANGO_HOST
-            value:
-              _default: http://backend-svc.django.svc.cluster.local:80
-          - name: DJANGO_ORIGINATOR
-            value:
-              _default: docs_prod
-          - name: DOCUMENTATION_URL
-            value:
-              _default: http://backend-api-svc.documentations.svc.cluster.local:80/
-          - name: EAV_URL
-            value:
-              _default: http://backend-svc.eav.svc.cluster.local:80
-          - name: ENABLE_OBSERVABILITY
-            value:
-              _default: "false"
-          - name: ENABLE_S3
-            value:
-              _default: "1"
-          - name: ENABLE_SSL
-            value:
-              _default: "0"
-          - name: ENVIRONMENT
-            value:
-              _default: prod
-          - name: FLOWS_URL
-            value:
-              _default: http://backend-svc.flows.svc.cluster.local:80
-          - name: HEIGHT_THUMB_ATTACHMENTS
-            value:
-              _default: "300"
-          - name: HEIGHT_THUMB_STATES
-            value:
-              _default: "73"
-          - name: HTTP_PORT
-            value:
-              _default: "8080"
-          - name: INSPECTIONS_URL
-            value:
-              _default: http://inspections-service.inspections.svc.cluster.local:80
-          - name: LOG_LEVEL
-            value:
-              _default: INFO
-          - name: NOTES_URL
-            value:
-              _default: ""
-          - name: OBSERVABILITY_COLLECTOR_ENDPOINT
-            value:
-              _default: temp
-          - name: READ_WRITE_TIMEOUT_FILE_STREAM
-            value:
-              _default: 6h
-          - name: RELEASES_URL
-            value:
-              _default: https://gitlab.com
-          - name: REMARKS_URL
-            value:
-              _default: http://remarks-static-service.remarks.svc.cluster.local:8080/remarks
-          - name: RESOURCES_URL
-            value:
-              _default: http://iam-backend.iam.svc.cluster.local:8000
-          - name: S3_SERVICE_ACCOUNT
-            value:
-              _default: /vault/secrets/documentations-s3-account-json
-          - name: STATES_URL
-            value:
-              _default: http://backend-svc.workspaces.svc.cluster.local:80/
-          - name: SUBSCRIPTIONS_URL
-            value:
-              _default: http://backend-svc.subscriptions.svc.cluster.local:80
-          - name: SYSTEM_LOG_URL
-            value:
-              _default: http://api-service.system-log.svc.cluster.local:80
-          - name: TARGET_URL
-            value:
-              _default: http://backend-svc.django.svc.cluster.local:80
-          - name: USE_CACHE_IN_FILE_STREAMER
-            value:
-              _default: "1"
-          - name: USE_SUBSCRIPTIONS
-            value:
-              _default: "false"
-          - name: WIDTH_THUMB_ATTACHMENTS
-            value:
-              _default: "300"
-          - name: WIDTH_THUMB_STATES
-            value:
-              _default: "120"
-          - name: WORKFLOWS_IMAGES_VERSION
-            value:
-              _default: master
-          - name: WORKFLOW_IMAGES_VERSION
-            value:
-              _default: master
-          - name: RELEASES_TOKEN
-            value:
-              _default: "mock"
-          - name: WORKFLOW_URL
-            value:
-              _default: http://backend-svc.workflow.svc.cluster.local:80/
-          - name: WORKSPACE_BUNDLE_VERSION
-            value:
-              _default: v1
-          - name: WORKSPACE_URL
-            value:
-              _default: http://backend-svc.workspaces.svc.cluster.local:80/

apps/documentations/wb/redis.yaml

@@ -0,0 +1,88 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: redis
+  namespace: documentations
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      redis:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/redis:latest
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: redis
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 6379
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: redis
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 6379
+
+          targetPort:
+            _default: 6379
+
+          portName:
+            _default: tcp
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/documentations/wb/stamp-verification.yaml

@@ -0,0 +1,90 @@
+---
+# stamp-verification — отдельное приложение (apps/stamp-verification),
+# в wb развёрнуто в ns documentations, а не в своём собственном неймспейсе.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: stamp-verification
+  namespace: documentations
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      stamp-verification:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/stamp-verification-frontend:e11a8f90be462fc325ff99c8c35a8a418815c27b
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: stamp-verification
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8080
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: stamp-verification-frontend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8080
+
+          targetPort:
+            _default: 8080
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/drawings/wb/backend.yaml

@@ -0,0 +1,120 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: drawings-api
+  namespace: drawings
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      drawings-api:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/drawings-api:015e68e1b2a3dcc13f0b405e1f761b154a825d24
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: drawings-api
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8080
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: drawings-api-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 8080
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        envs:
+          - name: POSTGRES_ADDRESS
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru:5432"
+
+          - name: POSTGRES_DB
+            value:
+              _default: "drawings_db"
+
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "3"
+
+          - name: API_ADDRESS
+            value:
+              _default: "0.0.0.0:8080"
+
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+
+        secretEnvs:
+          - name: POSTGRES_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: POSTGRES_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/drawings/wb/kustomization.yaml

@@ -3,4 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: drawings
 resources:
-  - ../base
+  - backend.yaml

apps/eav/wb/backend.yaml

@@ -0,0 +1,191 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: eav
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      backend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/eav:prod_0fb73247
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: backend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: eav-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: django-configmap
+              mountPath:
+                _default: /server/config/settings/production.py
+              subPath:
+                _default: production.py
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: django-configmap
+                items:
+                  - key: production.py
+                    path:
+                      _default: production.py
+
+            - name: kafka-cert-volume
+              mountPath:
+                _default: /usr/local/share/ca-certificates
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: kafka-cert
+
+        envs:
+          - name: KAFKA_USERNAME
+            value:
+              _default: "sarex"
+
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: "/usr/local/share/ca-certificates/kafka.crt"
+
+          - name: KAFKA_HOST
+            value:
+              _default: "wb-stage-kafka-bootstrap.kafka.svc.cluster.local:9093"
+
+          - name: KAFKA_ENABLED
+            value:
+              _default: "False"
+
+          - name: ASSETS_TOPIC
+            value:
+              _default: "sarex"
+
+          - name: DJANGO_SETTINGS_MODULE
+            value:
+              _default: "config.settings.production"
+
+          - name: DJANGO_POSTGRES_HOST
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: DJANGO_POSTGRES_DATABASE
+            value:
+              _default: "eav_db"
+
+          - name: YC_S3_ENDPOINT_URL
+            value:
+              _default: "http://minio-svc.minio.svc.cluster.local:9000"
+
+          - name: YC_S3_BUCKET_NAME
+            value:
+              _default: "eav"
+
+        secretEnvs:
+          - name: KAFKA_PASSWORD
+            secretName:
+              _default: "kafka-cred"
+            secretKey: "password"
+
+          - name: DJANGO_POSTGRES_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: DJANGO_POSTGRES_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: JWT_PRIVATE_KEY
+            secretName:
+              _default: "backend-secret"
+            secretKey: "ssh_private.key"
+
+          - name: JWT_PUBLIC_KEY
+            secretName:
+              _default: "backend-secret"
+            secretKey: "ssh_public.key"
+
+          - name: YC_S3_ACCESS_KEY_ID
+            secretName:
+              _default: "s3-secret"
+            secretKey: "login"
+
+          - name: YC_S3_SECRET_ACCESS_KEY
+            secretName:
+              _default: "s3-secret"
+            secretKey: "password"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/eav/wb/django-configmap.yaml

@@ -0,0 +1,147 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: django-configmap
+  namespace: eav
+data:
+  production.py: |
+    # production.py
+
+    from .base import *
+    from datetime import timedelta
+    import os
+    from django.core.exceptions import ImproperlyConfigured
+
+    INSTALLED_APPS.append("corsheaders")
+    #MIDDLEWARE = ["corsheaders.middleware.CorsMiddleware"] + MIDDLEWARE
+
+    # DEBUG SETTINGS START
+    # ---------------------------------------------------------------------------------------------------------------------
+    DEBUG = True
+    ALLOWED_HOSTS = ['*']
+    # ---------------------------------------------------------------------------------------------------------------------
+    # DEBUG SETTINGS END
+
+    # DATABASE SETTINGS START
+    # ---------------------------------------------------------------------------------------------------------------------
+    DATABASES = {
+        "default": {
+            "ENGINE": "django.db.backends.postgresql",
+            "NAME": os.getenv("DJANGO_POSTGRES_DATABASE"),
+            "USER": os.getenv("DJANGO_POSTGRES_USER"),
+            "PASSWORD": os.getenv("DJANGO_POSTGRES_PASSWORD"),
+            "HOST": os.getenv("DJANGO_POSTGRES_HOST"),
+            "PORT": "5432",
+        }
+    }
+    # ---------------------------------------------------------------------------------------------------------------------
+    # DATABASE SETTINGS END
+
+    # RESPONSE HEADERS START
+    # ---------------------------------------------------------------------------------------------------------------------
+    CORS_ORIGIN_ALLOW_ALL = True
+
+    CORS_ALLOWED_ORIGINS = [
+        "https://srx.wb.ru",
+    ]
+
+    CORS_TRUSTED_ORIGINS = [
+        "https://srx.wb.ru",
+    ]
+
+    CSRF_TRUSTED_ORIGINS = [
+        "https://srx.wb.ru",
+    ]
+
+    CORS_ALLOW_METHODS = (
+        'DELETE',
+        'GET',
+        'OPTIONS',
+        'PATCH',
+        'POST',
+        'PUT',
+    )
+
+    CORS_ALLOW_HEADERS = (
+        'accept',
+        'accept-encoding',
+        'authorization',
+        'content-type',
+        'user-agent',
+        'x-csrftoken',
+        'x-requested-with',
+        'x-token',
+        'Bearer'
+    )
+    # ---------------------------------------------------------------------------------------------------------------------
+    # RESPONSE HEADERS END
+
+    REST_FRAMEWORK = {
+        "DEFAULT_PAGINATION_CLASS": (
+            "rest_framework.pagination.LimitOffsetPagination"
+        ),
+        "DEFAULT_SCHEMA_CLASS": "rest_framework.schemas.coreapi.AutoSchema",
+        "PAGE_SIZE": 10000,
+        "DEFAULT_FILTER_BACKENDS": [
+            "django_filters.rest_framework.DjangoFilterBackend"
+        ],
+        "DEFAULT_AUTHENTICATION_CLASSES": [
+            "core.auth.ZitadelJWTAuthentication",
+            "rest_framework_simplejwt.authentication.JWTAuthentication",
+            "rest_framework.authentication.SessionAuthentication",
+            "rest_framework.authentication.BasicAuthentication",
+        ],
+        "DEFAULT_PERMISSION_CLASSES": [
+            "rest_framework.permissions.AllowAny",
+        ]
+    }
+
+    # JWT SETTINGS START
+    # ---------------------------------------------------------------------------------------------------------------------
+    def get_env_variable(var_name, default=None):
+        try:
+            return os.getenv(var_name, default)
+        except KeyError:
+            error_msg = f"Set the {var_name} environment variable"
+            if default:
+                return default
+            raise ImproperlyConfigured(error_msg)
+
+    SIMPLE_JWT_ISSUER = get_env_variable("SIMPLE_JWT_ISSUER", default="django")
+
+    SIMPLE_JWT = {
+        "ACCESS_TOKEN_LIFETIME": timedelta(minutes=5),
+        "REFRESH_TOKEN_LIFETIME": timedelta(days=1),
+        "ROTATE_REFRESH_TOKENS": False,
+        "UPDATE_LAST_LOGIN": False,
+
+        "ALGORITHM": "RS512",
+        "SIGNING_KEY": get_env_variable("JWT_PRIVATE_KEY").replace("\\\n", "\n"),
+        "VERIFYING_KEY": get_env_variable("JWT_PUBLIC_KEY").replace("\\\n", "\n"),
+        "AUDIENCE": None,
+        "ISSUER": SIMPLE_JWT_ISSUER,
+
+        "AUTH_HEADER_TYPES": ("Bearer",),
+        "AUTH_HEADER_NAME": "HTTP_AUTHORIZATION",
+        "USER_ID_FIELD": "id",
+        "USER_ID_CLAIM": "user_id",
+
+        "AUTH_TOKEN_CLASSES": ("rest_framework_simplejwt.tokens.AccessToken",),
+        "TOKEN_TYPE_CLAIM": "token_type",
+
+        "JTI_CLAIM": "jti",
+
+        "SLIDING_TOKEN_REFRESH_EXP_CLAIM": "refresh_exp",
+        "SLIDING_TOKEN_LIFETIME": timedelta(minutes=5),
+        "SLIDING_TOKEN_REFRESH_LIFETIME": timedelta(days=1),
+    }
+    # ---------------------------------------------------------------------------------------------------------------------
+    # JWT SETTINGS END
+
+    STATIC_ROOT = '/static/'
+    STATIC_URL = '/static/'
+    STATICFILES_STORAGE = 'django.contrib.staticfiles.storage.StaticFilesStorage'
+
+    SESSION_COOKIE_NAME = 'eav-sessionid'
+    CSRF_COOKIE_NAME = 'eav-csrftoken'

apps/eav/wb/kafka-cert-configmap.yaml

@@ -0,0 +1,38 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kafka-cert
+  namespace: eav
+data:
+  kafka.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIIFLTCCAxWgAwIBAgIUA5L48eHPMqNFYE5wIgaOmWgG3okwDQYJKoZIhvcNAQEN
+    BQAwLTETMBEGA1UECgwKaW8uc3RyaW16aTEWMBQGA1UEAwwNY2x1c3Rlci1jYSB2
+    MDAeFw0yNTA2MDQxMTMzMTRaFw0yNjA2MDQxMTMzMTRaMC0xEzARBgNVBAoMCmlv
+    LnN0cmltemkxFjAUBgNVBAMMDWNsdXN0ZXItY2EgdjAwggIiMA0GCSqGSIb3DQEB
+    AQUAA4ICDwAwggIKAoICAQDV2NBVwnXISH9i8K4KxSd2AThwgQyRKyeIfcqeYZ4F
+    7FguEUI7uEtoWd4uO8DsIzoMoLYv5L1DfhNYUFWN3XYQd4XVFnwYQYbwspdC1L8G
+    u0T7943gRRRomcNP8n5nycfeZgZgmz9IS8vmxgRh4ao0kcCW49uBQMd706087UAI
+    qaRJTcabTZq1LTeoH9AOAyT/nawKm+1H5VmrMUBjzz9xKVXF0sCrhjYoZoM4x+fY
+    AphtxZDB21ZhEcHBbytEQkEm0QTbUP4xbu95yqY6goYi9S9R1uMgVZ9DoJVwyqLm
+    /3ZGPjd9VmdBPO/zE/Bj890DjyKS7AXo9d+Iyv4M2QD1jA+5j4JyHzk7Lroz+HTg
+    mwVpcVGafBWIC4qFt7C3UYt6IV64/MA2v9gxTIdJvOBZxKUiMl7f65jKNEntF6is
+    86QCkjhvt34AThEoGx8SPjVr3sOBuneqcybeSYLyEWFg9Z1mWfMLHlA/Fp/Y2wpM
+    w1ZXj6uAa/UNUAIfkaLTOKHHaCCVD2G3Vkm94NHOJmDj6ze8P0J0H+Ub6ULD7hHr
+    8obOSk9OvxoxVzE+UW7DyEL6YD8MBVUQKJIQVgZmpT4akWyz8bNhFRzgTnKAhwNN
+    ATrGmjfX/wj7tCpy/PoJjEiu54sXW5xplBIz/ZgYHrPkyrbhQxsRozgQ+UIMIIbJ
+    /wIDAQABo0UwQzAdBgNVHQ4EFgQUkU4HKndgWxhcXMAe5XBc4OJwSgcwEgYDVR0T
+    AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQENBQADggIB
+    AFLi5QLawZollou3+m5kYcBe5F8xKG5NlgNmKyIREnwD2AP4xrr2tNFbmP2hpEl4
+    bWJJ84IHlKjpYxFLboWzgtW/JvdxcEh0K/x8/7cOD3Kk9d/LR9muj57mFYSQGlbo
+    g0+lHNuLam8xGcnGVV5VdfcjFz72/q92ndTlJmz+v6OneTJvIypKoBmNKF25alz9
+    pR2sTwoG0Pcwm30u/uS6pOewQ4sTiniOcc1MFYF7tl/Zz9Mqza8Rer0B5nm8lE/J
+    Yo9UaEXyVLM8Y5kSOkxMlOK+8/UMeY/lcQYpd5tYVpvarnoPCjmUjt4iVw26ZsAH
+    y4/vNW+wX+Uauarik1jHL/SauAjS3FbJoH06BBnji7J/Rud2DtSd+vVZrIBLJkaH
+    +Xg/roD3xKx0XmhLJmPvxGrkyehbhkbJkPKCHa9P56rnev3MYjyy+SV7Vp8Dq+HF
+    Wkswl3QUPWx9reuvF2KMyt04Tw94UAxCUGkX5qg7Dq5d0Fj/AcIrFdLTCV8eG/UI
+    1kKRxmZ2/ALINBOlfJOVVovKBlWpPACs8iy6XreOXtoQfzoG2F9Vo3Jmzjpqsmz0
+    9Ao4s2vcz3UuDtBhpwGp4N3zroyst/kQjtZirj4cS7fu75tB5N5mQ/tTwg0Tiw+Y
+    XIdxeE73V5DAf4Dd5V1VdCbA6oQv5qJYvinYydyx4x3V
+    -----END CERTIFICATE-----

apps/eav/wb/kustomization.yaml

@@ -3,4 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: eav
 resources:
-  - ../base
+  - django-configmap.yaml
+  - kafka-cert-configmap.yaml
+  - backend.yaml

apps/faas/wb/backend.yaml

@@ -1,21 +1,87 @@
 ---
-# Патч backend для контура wb.
-#
-# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
-# поэтому здесь продублирован весь набор из apps/faas/base/backend.yaml.
-#
-# В base BASE_HOST/DJANGO_HOST/REVIEWS_HOST/GATEWAY_HOST/DOCUMENTATIONS_HOST
-# смотрят на тестовый контур contour.infra.sarex.tech — для wb это srx.wb.ru
-# (ugmk эти поля тоже не переопределял — тот же неисправленный дефолт).
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
   name: export-reviews
   namespace: faas
+
 spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
   values:
+    global:
+      env: _default
+
     services:
-      backend:
+      export-reviews:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/export-reviews:prod_c4cae4ee
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: export-reviews
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: export-reviews-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
         envs:
           - name: BASE_HOST
             value:
@@ -39,7 +105,7 @@ spec:
 
           - name: EAV_HOST
             value:
-              _default: "http://backend-svc.eav.svc.cluster.local:80"
+              _default: "http://eav-service.eav.svc.cluster.local:8000"
 
           - name: TRANSMITTALS_INTERNAL_HOST
             value:
@@ -72,3 +138,8 @@ spec:
           - name: TIMEOUT
             value:
               _default: "180"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/faas/wb/kustomization.yaml

@@ -3,9 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: faas
 resources:
-  - ../base
+  - backend.yaml
-patches:
-  - path: backend.yaml
-    target:
-      kind: HelmRelease
-      name: export-reviews

apps/flows/wb/authentication-configmap.yaml

@@ -0,0 +1,93 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: authentication
+  namespace: flows
+data:
+  authentication.py: |
+    import httpx
+
+    from fastapi import Request, status
+    from itsdangerous import URLSafeTimedSerializer, BadData as BadDataError
+    from sqladmin.authentication import AuthenticationBackend
+
+    from flow.config import settings
+
+
+    class AdminAuthentication(AuthenticationBackend):
+        def get_serializer(self) -> URLSafeTimedSerializer:
+            return URLSafeTimedSerializer(
+                secret_key=settings.admin_panel.secret_key,
+            )
+
+        async def login(self, request: Request) -> bool:
+            form = await request.form()
+            username, password = form["username"], form["password"]
+            token_payload = {
+                    'is_django_user': False,
+                    'user_id': None,
+                }
+            # получаем данные о юзере
+            if True:
+                #print("OK"*30)
+                # client: httpx.AsyncClient = settings.django.get_async_session(token=settings.django.token)
+                # async with client as session:
+                #     auth_response = await session.post(url='/login/', json={
+                #         'username': username,
+                #         'password': password,
+                #     }, follow_redirects=False)
+                #     print("*"*30, auth_response.status_code ,settings.django.host, username, password,"*"*30)
+                #     if auth_response.status_code != status.HTTP_200_OK:
+                #         return False
+
+                    # django_response = await session.get(url='/client/settings/')
+                    # print("$"*30, django_response.status_code, "$"*30)
+                    # if django_response.status_code != status.HTTP_200_OK:
+                    #     return False
+                    if username == "68Lvh2PsHd5y" and password == "Hnzvh2PsHd5yI1v":
+                        #user = django_response.json()
+                        has_access = True
+                        if not has_access:
+                            return False
+
+                        user_id = 2
+
+                        token_payload = {
+                            'is_django_user': True,
+                            'user_id': user_id,
+                        }
+            else:
+                token_payload = {
+                    'is_django_user': False,
+                    'user_id': None,
+                }
+
+            token = self.get_serializer().dumps(token_payload)
+
+            request.session.update({"token": token})
+            return True
+
+        async def logout(self, request: Request) -> bool:
+            request.session.clear()
+            return True
+
+        async def authenticate(self, request: Request) -> bool:
+            token = request.session.get("token")
+
+            if not token:
+                return False
+
+            try:
+                payload = self.get_serializer().loads(token, max_age=settings.admin_panel.token_max_age)
+            except (BadDataError, KeyError):
+                return False
+
+            is_django_user = payload.get('is_django_user')
+            if settings.django.use != is_django_user:
+                return False
+
+            return True
+
+
+    authentication_backend = AdminAuthentication(secret_key=settings.admin_panel.secret_key)

apps/flows/wb/backend.yaml

@@ -1,19 +1,104 @@
 ---
-# Патч backend для контура wb.
-#
-# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
-# поэтому здесь продублирован весь набор из apps/flows/base/backend.yaml.
-# Единственное изменение — WORKFLOWS_HOST: в base смотрит на ns processing,
-# в wb processing развёрнут в ns workflow (apps/processing/wb).
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
   name: backend
   namespace: flows
+
 spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
   values:
+    global:
+      env: _default
+
     services:
       backend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_2a439111
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: backend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: backend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: authentication
+              mountPath:
+                _default: /opt/src/flow/admin/authentication.py
+              subPath:
+                _default: authentication.py
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: authentication
+                items:
+                  - key: authentication.py
+                    path:
+                      _default: authentication.py
+
         envs:
           - name: LOG_LEVEL
             value:
@@ -29,15 +114,15 @@ spec:
 
           - name: EAV_HOST
             value:
-              _default: "http://backend-svc.eav.svc.cluster.local:80"
+              _default: "http://eav-service.eav.svc.cluster.local:8000"
 
           - name: DJANGO_HOST
             value:
-              _default: "http://backend-svc.django.svc.cluster.local:80/api"
+              _default: "http://backend.django.svc.cluster.local:8000/api"
 
           - name: PLANNING_HOST
             value:
-              _default: "http://backend-svc.pm.svc.cluster.local:8000/api/pm/msp"
+              _default: "http://backend-service.pm.svc.cluster.local:8000/api/pm/msp"
 
           - name: PLANNING_USE
             value:
@@ -45,11 +130,11 @@ spec:
 
           - name: DOCUMENTATION_HOST
             value:
-              _default: "http://backend-api-svc.documentations.svc.cluster.local:80/internal/v1"
+              _default: "http://documentations-api.documentations.svc.cluster.local:8080/internal/v1"
 
           - name: DOCUMENTATION_EXTERNAL_HOST
             value:
-              _default: "http://backend-api-svc.documentations.svc.cluster.local:80/api/v1"
+              _default: "http://documentations-api.documentations.svc.cluster.local:8080/api/v1"
 
           - name: ENABLE_ANALYTICS
             value:
@@ -73,11 +158,27 @@ spec:
 
           - name: GATEWAY_URL
             value:
-              _default: "http://pdm-svc.documentations.svc.cluster.local:80"
+              _default: "http://pdm-api.documentations.svc.cluster.local:8080"
+
+          - name: PG_HOST
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: PG_PORT
+            value:
+              _default: "5432"
+
+          - name: RABBITMQ_HOST
+            value:
+              _default: "rabbitmq.rabbitmq.svc.cluster.local"
+
+          - name: RABBITMQ_PORT
+            value:
+              _default: "5672"
 
           - name: RESOURCE_URL
             value:
-              _default: "http://iam-backend.iam.svc.cluster.local:8000"
+              _default: "http://resources-service.resources.svc.cluster.local:8000"
 
           - name: SERVICE_HOST
             value:
@@ -87,6 +188,22 @@ spec:
             value:
               _default: "mail.rwb.ru"
 
+          - name: DOCUMENTATION_PG_PORT
+            value:
+              _default: "5432"
+
+          - name: PROXY_PATH_PREFIX
+            value:
+              _default: "/flows"
+
+          - name: DOCUMENTATION_PG_DATABASE
+            value:
+              _default: "documentations_db"
+
+          - name: DOCUMENTATION_PG_HOST
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
           - name: CHECKLIST_HOST
             value:
               _default: "http://checklists-backend-service.checklists.svc.cluster.local:80"
@@ -105,7 +222,7 @@ spec:
 
           - name: WORKFLOWS_HOST
             value:
-              _default: "http://backend-svc.workflow.svc.cluster.local:80/api/v1"
+              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000/api/v1"
 
           - name: WORKFLOWS_TIMEOUT
             value:
@@ -114,3 +231,64 @@ spec:
           - name: DOCUMENTATION_TIMEOUT
             value:
               _default: "60"
+
+        secretEnvs:
+          - name: ADMIN_PANEL_SECRET_KEY
+            secretName:
+              _default: "admin-secret"
+            secretKey: "key"
+
+          - name: JWT_PUBLIC_KEY
+            secretName:
+              _default: "jwt-secret"
+            secretKey: "public_key"
+
+          - name: DOCUMENTATION_PG_USERNAME
+            secretName:
+              _default: "postgres-secret-documentations"
+            secretKey: "username"
+
+          - name: DOCUMENTATION_PG_PASSWORD
+            secretName:
+              _default: "postgres-secret-documentations"
+            secretKey: "password"
+
+          - name: DJANGO_TOKEN
+            secretName:
+              _default: "django-secret"
+            secretKey: "token"
+
+          - name: PG_DB
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "database"
+
+          - name: PG_LOGIN
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: PG_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: RABBITMQ_USERNAME
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "username"
+
+          - name: RABBITMQ_PASSWORD
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "password"
+
+          - name: RABBITMQ_VHOST
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "vhost"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/flows/wb/celery.yaml

@@ -0,0 +1,308 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: celery
+  namespace: flows
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      celery:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_2a439111
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: celery
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          command:
+            _default: ["celery", "-A", "src.worker", "worker", "-l", "INFO", "-E", "--concurrency=1", "-Q", "flow"]
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: false
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        envs:
+          - name: LOG_LEVEL
+            value:
+              _default: "DEBUG"
+
+          - name: FLOWS_HOST
+            value:
+              _default: "http://backend-service.flows.svc.cluster.local:8000"
+
+          - name: DOCUMENTATION_PG_PORT
+            value:
+              _default: "5432"
+
+          - name: DOCUMENTATION_PG_DATABASE
+            value:
+              _default: "documentations_db"
+
+          - name: DOCUMENTATION_PG_HOST
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: BASE_HOST
+            value:
+              _default: "https://lk.srx.wb.ru:30443"
+
+          - name: CELERY_QUEUE
+            value:
+              _default: "flow"
+
+          - name: RESOURCES_HOST
+            value:
+              _default: "http://resources-service.resources.svc.cluster.local:8000/"
+
+          - name: DJANGO_HOST
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000/api"
+
+          - name: DOCUMENTATION_HOST
+            value:
+              _default: "http://documentations-api.documentations.svc.cluster.local:8080/internal/v1"
+
+          - name: DOCUMENTATION_EXTERNAL_HOST
+            value:
+              _default: "http://documentations-api.documentations.svc.cluster.local:8080/api/v1"
+
+          - name: ENABLE_ANALYTICS
+            value:
+              _default: "1"
+
+          - name: FLOWS_DB_HOST
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: FLOWS_DB_PORT
+            value:
+              _default: "5432"
+
+          - name: ISSUES_DB_PORT
+            value:
+              _default: "5432"
+
+          - name: ISSUES_DB_HOST
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: ENABLE_CELERY
+            value:
+              _default: "1"
+
+          - name: ENABLE_MAILGUN
+            value:
+              _default: "0"
+
+          - name: ENABLE_METRICS
+            value:
+              _default: "0"
+
+          - name: FROM_EMAIL
+            value:
+              _default: "wb@wb.ru"
+
+          - name: GATEWAY_URL
+            value:
+              _default: "http://pdm-api.documentations.svc.cluster.local:8080"
+
+          - name: PG_HOST
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: PG_PORT
+            value:
+              _default: "5432"
+
+          - name: RABBITMQ_HOST
+            value:
+              _default: "rabbitmq.rabbitmq.svc.cluster.local"
+
+          - name: RABBITMQ_PORT
+            value:
+              _default: "5672"
+
+          - name: DJANGO_BASE_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: RESOURCE_URL
+            value:
+              _default: "http://resources-service.resources.svc.cluster.local:8000"
+
+          - name: SERVICE_HOST
+            value:
+              _default: "https://lk.srx.wb.ru:30443/flows/api/v1"
+
+          - name: SMTP_HOST
+            value:
+              _default: "smtp-relay.wb.com"
+
+          - name: SMTP_PORT
+            value:
+              _default: "587"
+
+          - name: SYNC_RESOURCE_ID
+            value:
+              _default: "1"
+
+          - name: TIMEOUT
+            value:
+              _default: "120"
+
+          - name: WORKFLOWS_HOST
+            value:
+              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000/api/v1"
+
+          - name: WORKFLOWS_TIMEOUT
+            value:
+              _default: "60"
+
+          - name: DOCUMENTATION_TIMEOUT
+            value:
+              _default: "60"
+
+        secretEnvs:
+          - name: ADMIN_PANEL_SECRET_KEY
+            secretName:
+              _default: "admin-secret"
+            secretKey: "key"
+
+          - name: JWT_PUBLIC_KEY
+            secretName:
+              _default: "jwt-secret"
+            secretKey: "public_key"
+
+          - name: DOCUMENTATION_PG_USERNAME
+            secretName:
+              _default: "postgres-secret-documentations"
+            secretKey: "username"
+
+          - name: DOCUMENTATION_PG_PASSWORD
+            secretName:
+              _default: "postgres-secret-documentations"
+            secretKey: "password"
+
+          - name: FLOWS_DB_DB
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "database"
+
+          - name: FLOWS_DB_USERNAME
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: FLOWS_DB_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: ISSUES_DB_DB
+            secretName:
+              _default: "postgres-secret-issues"
+            secretKey: "database"
+
+          - name: ISSUES_DB_USERNAME
+            secretName:
+              _default: "postgres-secret-issues"
+            secretKey: "username"
+
+          - name: ISSUES_DB_PASSWORD
+            secretName:
+              _default: "postgres-secret-issues"
+            secretKey: "password"
+
+          - name: DJANGO_AUTH
+            secretName:
+              _default: "django-secret"
+            secretKey: "token"
+
+          - name: DJANGO_TOKEN
+            secretName:
+              _default: "django-secret"
+            secretKey: "token"
+
+          - name: PG_DB
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "database"
+
+          - name: PG_LOGIN
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: PG_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: RABBITMQ_USERNAME
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "username"
+
+          - name: RABBITMQ_PASSWORD
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "password"
+
+          - name: RABBITMQ_VHOST
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "vhost"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/flows/wb/frontend.yaml

@@ -0,0 +1,95 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: flows
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      frontend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_5b2bd144
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: frontend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          resources:
+            requests:
+              cpu:
+                _default: 100m
+              memory:
+                _default: 100Mi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: frontend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/flows/wb/kustomization.yaml

@@ -3,9 +3,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: flows
 resources:
-  - ../base
+  - authentication-configmap.yaml
-patches:
+  - backend.yaml
-  - path: backend.yaml
+  - celery.yaml
-    target:
+  - frontend.yaml
-      kind: HelmRelease
-      name: backend

apps/inspections/wb/backend.yaml

@@ -1,19 +1,87 @@
 ---
-# Патч backend для контура wb.
-#
-# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
-# поэтому здесь продублирован весь набор из apps/inspections/base/backend.yaml.
-# Единственное изменение — WORKFLOWS_URL: в base смотрит на ns processing,
-# в wb processing развёрнут в ns workflow (apps/processing/wb).
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
-  name: backend
+  name: inspections-backend
   namespace: inspections
+
 spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
   values:
+    global:
+      env: _default
+
     services:
-      backend:
+      api:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:production_1a33f6f4
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: inspections-backend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: sarex-inspections-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
         envs:
           - name: DEBUG
             value:
@@ -73,15 +141,18 @@ spec:
 
           - name: EAV_URL
             value:
-              _default: "http://backend-svc.eav.svc.cluster.local:80"
+              _default: "http://eav-service.eav"
 
           - name: EAV_TIMEOUT
             value:
               _default: "30"
 
+          # В дампе кластера значение было http://workflows-service.processing-prod —
+          # тот же неймспейс, что в вопросе про processing/workflow: реальный
+          # ns у processing в wb — workflow.
           - name: WORKFLOWS_URL
             value:
-              _default: "http://backend-svc.workflow.svc.cluster.local:80"
+              _default: "http://workflows-service.workflow"
 
           - name: WORKFLOWS_TIMEOUT
             value:
@@ -110,3 +181,54 @@ spec:
           - name: MAILER_TIMEOUT
             value:
               _default: "30"
+
+        secretEnvs:
+          - name: DATABASE_USER
+            secretName:
+              _default: "pg-secret"
+            secretKey: "username"
+
+          - name: DATABASE_PORT
+            secretName:
+              _default: "pg-secret"
+            secretKey: "port"
+
+          - name: DATABASE_NAME
+            secretName:
+              _default: "pg-secret"
+            secretKey: "database"
+
+          - name: DATABASE_HOST
+            secretName:
+              _default: "pg-secret"
+            secretKey: "host"
+
+          - name: DATABASE_PASSWORD
+            secretName:
+              _default: "pg-secret"
+            secretKey: "password"
+
+          - name: KAFKA_HOST
+            secretName:
+              _default: "kafka-secret"
+            secretKey: "host"
+
+          - name: KAFKA_USERNAME
+            secretName:
+              _default: "kafka-secret"
+            secretKey: "username"
+
+          - name: KAFKA_PASSWORD
+            secretName:
+              _default: "kafka-secret"
+            secretKey: "password"
+
+          - name: SAREX_BACKEND_AUTH
+            secretName:
+              _default: "sarex-backend-auth-secret"
+            secretKey: "key"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/inspections/wb/kustomization.yaml

@@ -3,9 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: inspections
 resources:
-  - ../base
+  - backend.yaml
-patches:
-  - path: backend.yaml
-    target:
-      kind: HelmRelease
-      name: backend

apps/issues/wb/app-configmap.yaml

@@ -0,0 +1,55 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: app
+  namespace: issues
+data:
+  app.py: |
+    import ssl
+    from django.conf import settings
+    from faststream import FastStream
+    from faststream.kafka import KafkaBroker
+    from faststream.security import BaseSecurity
+
+
+    def get_broker() -> KafkaBroker:
+        ssl_context = ssl.create_default_context(
+            cafile=settings.KAFKA_SSL_CAFILE,
+        )
+
+        # Сертификат передаем, но hostname не проверяем
+        ssl_context.check_hostname = False
+
+        # Для самоподписанного сертификата
+        ssl_context.verify_mode = ssl.CERT_NONE
+
+        security = BaseSecurity(
+            ssl_context=ssl_context,
+            use_ssl=True,
+        )
+
+        broker = KafkaBroker(
+            bootstrap_servers=[settings.KAFKA_HOST],
+            security=security,
+        )
+
+        return broker
+
+
+    def get_consumer_broker() -> KafkaBroker:
+        broker = get_broker()
+
+        from kafka_app.consumers import eav_router
+
+        broker.include_router(eav_router)
+
+        return broker
+
+
+    def configure_app() -> FastStream:
+        broker = get_consumer_broker()
+
+        app = FastStream(broker)
+
+        return app

apps/issues/wb/backend.yaml

@@ -1,85 +0,0 @@
----
-# Патч backend для контура wb.
-#
-# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
-# поэтому здесь продублирован весь набор из apps/issues/base/backend.yaml.
-# podAnnotations — map, мержится по ключам, поэтому переопределён только
-# agent-inject-template-issues-s3.
-#
-# В base AERO_*/SAREX_API смотрят на тестовый контур contour.infra.sarex.tech —
-# для wb это srx.wb.ru (apps/issues/base/celery.yaml уже использует его как
-# дефолт — переносим то же значение сюда, в base/backend.yaml почему-то ещё
-# contour). MinIO-бакет в base тоже неверный (rfi вместо issues) — из
-# terraform 1.yaml (infrastructure.minio.apps.issues для wb):
-# client.endpoint=https://minio-srx.wb.ru, buckets[0].name=issues.
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: backend
-  namespace: issues
-spec:
-  values:
-    services:
-      backend:
-        envs:
-          - name: ENVIRONMENT
-            value:
-              _default: "production"
-
-          - name: AERO_PUBLIC_HOST
-            value:
-              _default: "https://srx.wb.ru"
-
-          - name: AERO_HOST
-            value:
-              _default: "https://srx.wb.ru"
-
-          - name: BASE_AERO_URL
-            value:
-              _default: "https://srx.wb.ru"
-
-          - name: BASE_AUTH_URL
-            value:
-              _default: "http://backend-svc.django.svc.cluster.local:80"
-
-          - name: WORKFLOWS_HOST
-            value:
-              _default: "http://backend-svc.workflow.svc.cluster.local:80"
-
-          - name: WORKFLOWS_URL
-            value:
-              _default: "http://backend-svc.workflow.svc.cluster.local:80"
-
-          - name: RESOURCES_API_HOST
-            value:
-              _default: "http://iam-backend.iam.svc.cluster.local:8000"
-
-          - name: EAV_HOST
-            value:
-              _default: "http://backend-svc.eav.svc.cluster.local:80"
-
-          - name: SAREX_API
-            value:
-              _default: "https://srx.wb.ru"
-
-          - name: DOCUMENTATIONS_URL
-            value:
-              _default: "http://documentations-api-svc.documentations.svc.cluster.local:80"
-
-          - name: DJANGO_SETTINGS_MODULE
-            value:
-              _default: "config.settings.production"
-
-          - name: API_ADDRESS
-            value:
-              _default: "8000"
-
-        podAnnotations:
-          _default:
-            vault.hashicorp.com/agent-inject-template-issues-s3: |-
-              {{- with secret "secrets/data/minio/apps/issues" -}}
-              YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
-              YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
-              YC_S3_BUCKET_NAME=issues
-              YC_S3_ENDPOINT_URL=https://minio-srx.wb.ru
-              {{- end -}}

apps/issues/wb/celery.yaml

@@ -1,25 +1,281 @@
 ---
-# Патч celery для контура wb.
-#
-# В apps/issues/base/celery.yaml AERO_*/SAREX_API уже "https://srx.wb.ru" —
-# трогать envs не нужно. Но MinIO-бакет в base тоже неверный (rfi вместо
-# issues) — правим только podAnnotations (map, мержится по ключам).
-# См. подробности в apps/issues/wb/backend.yaml.
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
   name: celery
   namespace: issues
+
 spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
   values:
+    global:
+      env: _default
+
     services:
       celery:
-        podAnnotations:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_17c438aa
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: celery
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          command:
+            _default: ["celery", "-A", "config", "worker", "-l", "info", "-E"]
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: false
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
           _default:
-            vault.hashicorp.com/agent-inject-template-issues-s3: |-
+            - name: kafka-cert-volume
-              {{- with secret "secrets/data/minio/apps/issues" -}}
+              mountPath:
-              YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
+                _default: /usr/local/share/ca-certificates
-              YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
+              readOnly:
-              YC_S3_BUCKET_NAME=issues
+                _default: true
-              YC_S3_ENDPOINT_URL=https://minio-srx.wb.ru
+              configMap:
-              {{- end -}}
+                name:
+                  _default: kafka-cert
+
+            - name: app
+              mountPath:
+                _default: /src/kafka_app/app.py
+              subPath:
+                _default: app.py
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: app
+                items:
+                  - key: app.py
+                    path:
+                      _default: app.py
+
+            - name: uwsgi-configmap
+              mountPath:
+                _default: /opt/server/uwsgi.ini
+              subPath:
+                _default: uwsgi.ini
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: uwsgi-configmap
+                items:
+                  - key: uwsgi.ini
+                    path:
+                      _default: uwsgi.ini
+
+            - name: production-configmap
+              mountPath:
+                _default: /src/config/settings/production.py
+              subPath:
+                _default: production.py
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: production-configmap
+                items:
+                  - key: production.py
+                    path:
+                      _default: production.py
+
+        envs:
+          - name: ENVIRONMENT
+            value:
+              _default: "production"
+
+          - name: AERO_PUBLIC_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: AERO_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: BASE_AERO_URL
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: BASE_AUTH_URL
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: WORKFLOWS_HOST
+            value:
+              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000"
+
+          - name: WORKFLOWS_URL
+            value:
+              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000"
+
+          - name: RESOURCES_API_HOST
+            value:
+              _default: "http://resources-service.resources.svc.cluster.local:8000"
+
+          - name: EAV_HOST
+            value:
+              _default: "http://eav-service.eav.svc.cluster.local:8000"
+
+          - name: USE_NOTIFICATIONS
+            value:
+              _default: "True"
+
+          - name: ENABLE_MAILGUN
+            value:
+              _default: "False"
+
+          - name: SAREX_API
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: DOCUMENTATIONS_URL
+            value:
+              _default: "http://documentations-api.documentations.svc.cluster.local:8080"
+
+          - name: DJANGO_SETTINGS_MODULE
+            value:
+              _default: "config.settings.production"
+
+          - name: DATABASE_HOST
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: DATABASE_PORT
+            value:
+              _default: "5432"
+
+          - name: API_ADDRESS
+            value:
+              _default: "8000"
+
+          - name: RABBITMQ_HOSTNAME
+            value:
+              _default: "rabbitmq.rabbitmq.svc.cluster.local:5672"
+
+        secretEnvs:
+          - name: YC_S3_ACCESS_KEY_ID
+            secretName:
+              _default: "yc-s3-secret"
+            secretKey: "key_id"
+
+          - name: YC_S3_SECRET_ACCESS_KEY
+            secretName:
+              _default: "yc-s3-secret"
+            secretKey: "access_key"
+
+          - name: YC_S3_BUCKET_NAME
+            secretName:
+              _default: "yc-s3-secret"
+            secretKey: "storage_bucket_name"
+
+          - name: YC_S3_ENDPOINT_URL
+            secretName:
+              _default: "yc-s3-secret"
+            secretKey: "endpoint_url"
+
+          - name: DJANGO_BASIC_AUTH
+            secretName:
+              _default: "django-auth"
+            secretKey: "key"
+
+          - name: SAREX_USERNAME
+            secretName:
+              _default: "sarex-auth"
+            secretKey: "username"
+
+          - name: SAREX_PASSWORD
+            secretName:
+              _default: "sarex-auth"
+            secretKey: "password"
+
+          - name: DATABASE_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: DATABASE_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: DATABASE_NAME
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "database"
+
+          - name: RABBITMQ_VHOST
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "vhost"
+
+          - name: RABBITMQ_USERNAME
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "username"
+
+          - name: RABBITMQ_PASSWORD
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "password"
+
+          - name: JWT_PRIVATE_KEY
+            secretName:
+              _default: "backend-secret"
+            secretKey: "ssh_private.key"
+
+          - name: JWT_PUBLIC_KEY
+            secretName:
+              _default: "backend-secret"
+            secretKey: "ssh_public.key"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/issues/wb/issues.yaml

@@ -0,0 +1,270 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: issues
+  namespace: issues
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      issues:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/issues:wb_497411b7
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: issues
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: issues-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: kafka-cert-volume
+              mountPath:
+                _default: /usr/local/share/ca-certificates
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: kafka-cert
+
+            - name: uwsgi-configmap
+              mountPath:
+                _default: /opt/server/uwsgi.ini
+              subPath:
+                _default: uwsgi.ini
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: uwsgi-configmap
+                items:
+                  - key: uwsgi.ini
+                    path:
+                      _default: uwsgi.ini
+
+            - name: production-configmap
+              mountPath:
+                _default: /src/config/settings/production.py
+              subPath:
+                _default: production.py
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: production-configmap
+                items:
+                  - key: production.py
+                    path:
+                      _default: production.py
+
+        envs:
+          - name: ENVIRONMENT
+            value:
+              _default: "production"
+
+          - name: AERO_PUBLIC_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: AERO_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: BASE_AERO_URL
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: BASE_AUTH_URL
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+          - name: WORKFLOWS_HOST
+            value:
+              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000"
+
+          - name: WORKFLOWS_URL
+            value:
+              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000"
+
+          - name: RESOURCES_API_HOST
+            value:
+              _default: "http://resources-service.resources.svc.cluster.local:8000"
+
+          - name: EAV_HOST
+            value:
+              _default: "http://eav-service.eav.svc.cluster.local:8000"
+
+          - name: SAREX_API
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: DOCUMENTATIONS_URL
+            value:
+              _default: "http://documentations-api.documentations.svc.cluster.local:8080"
+
+          - name: DJANGO_SETTINGS_MODULE
+            value:
+              _default: "config.settings.production"
+
+          - name: DATABASE_HOST
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: DATABASE_PORT
+            value:
+              _default: "5432"
+
+          - name: API_ADDRESS
+            value:
+              _default: "8000"
+
+          - name: RABBITMQ_HOSTNAME
+            value:
+              _default: "rabbitmq.rabbitmq.svc.cluster.local:5672"
+
+        secretEnvs:
+          - name: YC_S3_ACCESS_KEY_ID
+            secretName:
+              _default: "yc-s3-secret"
+            secretKey: "key_id"
+
+          - name: YC_S3_SECRET_ACCESS_KEY
+            secretName:
+              _default: "yc-s3-secret"
+            secretKey: "access_key"
+
+          - name: YC_S3_BUCKET_NAME
+            secretName:
+              _default: "yc-s3-secret"
+            secretKey: "storage_bucket_name"
+
+          - name: YC_S3_ENDPOINT_URL
+            secretName:
+              _default: "yc-s3-secret"
+            secretKey: "endpoint_url"
+
+          - name: DJANGO_BASIC_AUTH
+            secretName:
+              _default: "django-auth"
+            secretKey: "key"
+
+          - name: SAREX_USERNAME
+            secretName:
+              _default: "sarex-auth"
+            secretKey: "username"
+
+          - name: SAREX_PASSWORD
+            secretName:
+              _default: "sarex-auth"
+            secretKey: "password"
+
+          - name: DATABASE_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: DATABASE_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: DATABASE_NAME
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "database"
+
+          - name: RABBITMQ_VHOST
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "vhost"
+
+          - name: RABBITMQ_USERNAME
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "username"
+
+          - name: RABBITMQ_PASSWORD
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "password"
+
+          - name: JWT_PRIVATE_KEY
+            secretName:
+              _default: "backend-secret"
+            secretKey: "ssh_private.key"
+
+          - name: JWT_PUBLIC_KEY
+            secretName:
+              _default: "backend-secret"
+            secretKey: "ssh_public.key"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/issues/wb/kafka-cert-configmap.yaml

@@ -0,0 +1,38 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kafka-cert
+  namespace: issues
+data:
+  kafka.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIIFLTCCAxWgAwIBAgIUA5L48eHPMqNFYE5wIgaOmWgG3okwDQYJKoZIhvcNAQEN
+    BQAwLTETMBEGA1UECgwKaW8uc3RyaW16aTEWMBQGA1UEAwwNY2x1c3Rlci1jYSB2
+    MDAeFw0yNTA2MDQxMTMzMTRaFw0yNjA2MDQxMTMzMTRaMC0xEzARBgNVBAoMCmlv
+    LnN0cmltemkxFjAUBgNVBAMMDWNsdXN0ZXItY2EgdjAwggIiMA0GCSqGSIb3DQEB
+    AQUAA4ICDwAwggIKAoICAQDV2NBVwnXISH9i8K4KxSd2AThwgQyRKyeIfcqeYZ4F
+    7FguEUI7uEtoWd4uO8DsIzoMoLYv5L1DfhNYUFWN3XYQd4XVFnwYQYbwspdC1L8G
+    u0T7943gRRRomcNP8n5nycfeZgZgmz9IS8vmxgRh4ao0kcCW49uBQMd706087UAI
+    qaRJTcabTZq1LTeoH9AOAyT/nawKm+1H5VmrMUBjzz9xKVXF0sCrhjYoZoM4x+fY
+    AphtxZDB21ZhEcHBbytEQkEm0QTbUP4xbu95yqY6goYi9S9R1uMgVZ9DoJVwyqLm
+    /3ZGPjd9VmdBPO/zE/Bj890DjyKS7AXo9d+Iyv4M2QD1jA+5j4JyHzk7Lroz+HTg
+    mwVpcVGafBWIC4qFt7C3UYt6IV64/MA2v9gxTIdJvOBZxKUiMl7f65jKNEntF6is
+    86QCkjhvt34AThEoGx8SPjVr3sOBuneqcybeSYLyEWFg9Z1mWfMLHlA/Fp/Y2wpM
+    w1ZXj6uAa/UNUAIfkaLTOKHHaCCVD2G3Vkm94NHOJmDj6ze8P0J0H+Ub6ULD7hHr
+    8obOSk9OvxoxVzE+UW7DyEL6YD8MBVUQKJIQVgZmpT4akWyz8bNhFRzgTnKAhwNN
+    ATrGmjfX/wj7tCpy/PoJjEiu54sXW5xplBIz/ZgYHrPkyrbhQxsRozgQ+UIMIIbJ
+    /wIDAQABo0UwQzAdBgNVHQ4EFgQUkU4HKndgWxhcXMAe5XBc4OJwSgcwEgYDVR0T
+    AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQENBQADggIB
+    AFLi5QLawZollou3+m5kYcBe5F8xKG5NlgNmKyIREnwD2AP4xrr2tNFbmP2hpEl4
+    bWJJ84IHlKjpYxFLboWzgtW/JvdxcEh0K/x8/7cOD3Kk9d/LR9muj57mFYSQGlbo
+    g0+lHNuLam8xGcnGVV5VdfcjFz72/q92ndTlJmz+v6OneTJvIypKoBmNKF25alz9
+    pR2sTwoG0Pcwm30u/uS6pOewQ4sTiniOcc1MFYF7tl/Zz9Mqza8Rer0B5nm8lE/J
+    Yo9UaEXyVLM8Y5kSOkxMlOK+8/UMeY/lcQYpd5tYVpvarnoPCjmUjt4iVw26ZsAH
+    y4/vNW+wX+Uauarik1jHL/SauAjS3FbJoH06BBnji7J/Rud2DtSd+vVZrIBLJkaH
+    +Xg/roD3xKx0XmhLJmPvxGrkyehbhkbJkPKCHa9P56rnev3MYjyy+SV7Vp8Dq+HF
+    Wkswl3QUPWx9reuvF2KMyt04Tw94UAxCUGkX5qg7Dq5d0Fj/AcIrFdLTCV8eG/UI
+    1kKRxmZ2/ALINBOlfJOVVovKBlWpPACs8iy6XreOXtoQfzoG2F9Vo3Jmzjpqsmz0
+    9Ao4s2vcz3UuDtBhpwGp4N3zroyst/kQjtZirj4cS7fu75tB5N5mQ/tTwg0Tiw+Y
+    XIdxeE73V5DAf4Dd5V1VdCbA6oQv5qJYvinYydyx4x3V
+    -----END CERTIFICATE-----

apps/issues/wb/kustomization.yaml

@@ -3,13 +3,12 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: issues
 resources:
-  - ../base
+  - app-configmap.yaml
-patches:
+  - production-configmap.yaml
-  - path: backend.yaml
+  - uwsgi-configmap.yaml
-    target:
+  - kafka-cert-configmap.yaml
-      kind: HelmRelease
+  - issues.yaml
-      name: backend
+  - celery.yaml
-  - path: celery.yaml
+  - redis.yaml
-    target:
+  - static.yaml
-      kind: HelmRelease
+  - remarks-static.yaml
-      name: celery

apps/issues/wb/production-configmap.yaml

@@ -0,0 +1,143 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: production-configmap
+  namespace: issues
+data:
+  production.py: |
+    from datetime import timedelta
+    import os
+    from .base import *
+
+    # DEBUG SETTINGS START
+    # -----------------------------------------------------------------------------
+    DEBUG = True
+    # -----------------------------------------------------------------------------
+
+    TEST_MODE = False
+    #USE_NOTIFICATIONS = False
+    AWS_S3_VERIFY=False
+
+    # SECRETS SETTINGS START
+    # -----------------------------------------------------------------------------
+    SECRET_KEY = "FromToMuchLoveOfLiving"  # Delete after Test
+    # -----------------------------------------------------------------------------
+
+    DJANGO_TOKEN="aGFnZW4wMTM6emVhbG90MDk2"
+
+    # ALLOWED HOSTS START
+    # -----------------------------------------------------------------------------
+    ALLOWED_HOSTS = ["*"]
+    # -----------------------------------------------------------------------------
+
+    # APPS SETTINGS START
+    # -----------------------------------------------------------------------------
+    # INSTALLED_APPS += [
+    #     "django_extensions",
+    # ]
+    # -----------------------------------------------------------------------------
+
+    # DEBUG SETTINGS START
+    # -----------------------------------------------------------------------------
+    DEBUG = True
+    # -----------------------------------------------------------------------------
+
+    REVIEW_HOST='http://backend-service.flows.svc.cluster.local:8000'
+    # -----------------------------------------------------------------------------
+    # EXTERNAL SERVICES END
+
+    WORKFLOWS_HOST = "http://workflows-api-service.workflow.svc.cluster.local:8000"
+    WORKFLOWS_URL = "http://workflows-api-service.workflow.svc.cluster.local:8000"
+    DOCUMENTATIONS_URL = "http://documentations-api.documentations.svc.cluster.local:8080"
+    RESOURCES_API_HOST = os.getenv("RESOURCES_API_HOST", default="http://resources-service.resources.svc.cluster:8000")
+    KAFKA_HOST = "wb-prod-kafka-bootstrap.kafka.svc.cluster.local:9093"
+    KAFKA_USERNAME = "sarex"
+    KAFKA_PASSWORD = "nK36sasvSfoItJnXQ4qxav2OUWIPX5ZC"
+    KAFKA_SSL_CAFILE = os.getenv("KAFKA_SSL_CAFILE", "/usr/local/share/ca-certificates/kafka.crt")
+    KAFKA_EAV_ASSETS_TOPIC = os.getenv("KAFKA_EAV_ASSETS_TOPIC", "sarex")
+    KAFKA_ISSUES_TOPIC = os.getenv("KAFKA_ISSUES_TOPIC", "sarex-issues")
+
+
+    USE_ASYNC_FUNCTIONS = True
+    #USE_NOTIFICATIONS = False
+
+    # JWT SETTINGS START
+    # ---------------------------------------------------------------------------------------------------------------------
+    SIMPLE_JWT_ISSUER = os.getenv("SIMPLE_JWT_ISSUER", default="default_issuer")
+
+    SIMPLE_JWT = {
+        "ACCESS_TOKEN_LIFETIME": timedelta(minutes=5),
+        "REFRESH_TOKEN_LIFETIME": timedelta(days=1),
+        "ROTATE_REFRESH_TOKENS": False,
+        "UPDATE_LAST_LOGIN": False,
+
+        "ALGORITHM": "RS512",
+        "SIGNING_KEY": os.getenv("JWT_PRIVATE_KEY", default="").replace("\\n", "\n"),
+        "VERIFYING_KEY": os.getenv("JWT_PUBLIC_KEY").replace("\\n", "\n"),
+        "AUDIENCE": None,
+        "ISSUER": SIMPLE_JWT_ISSUER,
+
+        "AUTH_HEADER_TYPES": ("Bearer",),
+        "AUTH_HEADER_NAME": "HTTP_AUTHORIZATION",
+        "USER_ID_FIELD": "id",
+        "USER_ID_CLAIM": "user_id",
+
+        "AUTH_TOKEN_CLASSES": ("rest_framework_simplejwt.tokens.AccessToken",),
+        "TOKEN_TYPE_CLAIM": "token_type",
+
+        "JTI_CLAIM": "jti",
+
+        "SLIDING_TOKEN_REFRESH_EXP_CLAIM": "refresh_exp",
+        "SLIDING_TOKEN_LIFETIME": timedelta(minutes=5),
+        "SLIDING_TOKEN_REFRESH_LIFETIME": timedelta(days=1),
+    }
+    # ---------------------------------------------------------------------------------------------------------------------
+
+    CORS_ALLOWED_ORIGINS = [
+        "https://lk.srx.wb.ru:30443",
+    ]
+
+    CORS_TRUSTED_ORIGINS = [
+        "https://lk.srx.wb.ru:30443",
+    ]
+
+    CSRF_TRUSTED_ORIGINS = [
+        "https://lk.srx.wb.ru:30443",
+    ]
+
+    CORS_ALLOW_ALL_ORIGINS = True
+    ENABLE_MAILGUN=False
+    SMTP_PORT=465
+    SMTP_HOST="mail.rwb.ru"
+    EMAIL_FROM="sarex@rwb.ru"
+
+    CORS_ALLOW_METHODS = [
+        "DELETE",
+        "GET",
+        "OPTIONS",
+        "PATCH",
+        "POST",
+        "PUT",
+    ]
+
+    SAREX_API = "https://srx.wb.ru"
+
+    AERO_PUBLIC_HOST = os.getenv("AERO_PUBLIC_HOST", default=SAREX_API)
+
+    BASE_AERO_URL = "http://backend.django.svc.cluster.local:8000"
+
+    ENVIRONMENT = "production"
+
+    SESSION_COOKIE_NAME = "issues-sessionid"
+    CSRF_COOKIE_NAME = "issues-csrftoken"
+    STATIC_URL = "/static/"
+    STORAGES = {
+        'default': {
+            'BACKEND': "storages.backends.s3boto3.S3Boto3Storage",
+        },
+        'staticfiles': {
+            # Leave whatever setting you already have here, e.g.:
+            'BACKEND': "storages.backends.s3boto3.S3Boto3Storage",
+        }
+    }

apps/issues/wb/redis.yaml

@@ -0,0 +1,88 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: redis
+  namespace: issues
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      redis:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/redis:latest
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: redis
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 6379
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: redis
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 6379
+
+          targetPort:
+            _default: 6379
+
+          portName:
+            _default: tcp
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/issues/wb/remarks-static.yaml

@@ -0,0 +1,90 @@
+---
+# remarks-static — компонент приложения remarks (apps/remarks), в wb
+# развёрнут в ns issues, а не в своём собственном неймспейсе.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: remarks-static
+  namespace: issues
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      remarks-static:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/remarks-frontend:wb_002f8896
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: remarks-static
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8080
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: remarks-static
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 8080
+
+          portName:
+            _default: tcp
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/issues/wb/static.yaml

@@ -0,0 +1,88 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: static
+  namespace: issues
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      static:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/contour_issues-frontend:716a2b73
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: static
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: static-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/issues/wb/uwsgi-configmap.yaml

@@ -0,0 +1,23 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: uwsgi-configmap
+  namespace: issues
+data:
+  uwsgi.ini: |-
+    [uwsgi]
+    plugins-dir = /usr/lib/uwsgi/plugins
+
+    chdir           = /src
+    module          = config.wsgi:application
+    master          = true
+    processes       = 4
+    http            = 0.0.0.0:8000
+    chmod-socket    = 666
+    vacuum          = true
+    harakiri        = 6000
+    buffer-size     = 32768
+
+    static-map = /static=/opt/src/static/
+    static-map = /media=/opt/src/media/

apps/message-hub/wb/kafka-cert-configmap.yaml

@@ -0,0 +1,38 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kafka-cert
+  namespace: message-hub
+data:
+  kafka.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIIFLTCCAxWgAwIBAgIUYDZPxGRsr7IiqHEmfd07QTQlOKYwDQYJKoZIhvcNAQEN
+    BQAwLTETMBEGA1UECgwKaW8uc3RyaW16aTEWMBQGA1UEAwwNY2x1c3Rlci1jYSB2
+    MDAeFw0yNTEyMTYxNDM0NTVaFw0yNjEyMTYxNDM0NTVaMC0xEzARBgNVBAoMCmlv
+    LnN0cmltemkxFjAUBgNVBAMMDWNsdXN0ZXItY2EgdjAwggIiMA0GCSqGSIb3DQEB
+    AQUAA4ICDwAwggIKAoICAQCfzDZhEzw2pbU5Xpu8OzD+3iQG+DVjU8PQWWQEF27h
+    yjohDkUr3zCZtW7xMKWKUNxBgrKsfe4TDOQN8cij3cS9sy0So+UhMeF7Bq9PU1Yd
+    bmTRq8q1PiuNUkiCGJ5wrb3+NZvVxZLJUIFgiealsRw80MgMWWSzy0I35T2Edn/a
+    DU4jhlgQxyzQ621+oGP0n28gCjmm6pCq2tkj/Z8WTdu1gOWyRdK02a2uE2Ts2nLa
+    Di32GaZrIbIuD/WUd6Ek66uCeJvh2CT7s+SqgtMbtT7gibUuPQ3hk1VGQsjy22l3
+    hUNpLu86nrwbuf21mY55KnLOcaVq1ag1TpIIKfZAL/KWFCGZ6H6kwEIbCAL0Hei7
+    cJ2Wm2/qlzKUeU869M7YybZAfXl/t6XT4QgFgje+42N980vy5A4GhWi1Z7lPqqOe
+    jPGBstkRZybKz1sTk87+oJx82iQU/ozVmzjSEK1SoYRNbvug8PNpxmPoPnJ2flgG
+    t2q2+2ZQP3f1aAHVcZ3U5+hWlRmKPXzjrJv7gnhuvqJl7OwB50y+yWiVfZ9xrYl2
+    EpX+yHuFFK+9NnB5taUK8Fz+hQaLU8J4q7P0bRqkoI+LdcEErjuDT/eI2d5+Ql8K
+    /JkV823hX2WNB9bdaQ24BelVUbsxGpR7ms6KWrM11kHnbzUlEM+AxZES6F7Qbr55
+    TwIDAQABo0UwQzAdBgNVHQ4EFgQUM7hshx7e9TFEN82Pf446aBrJUA4wEgYDVR0T
+    AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQENBQADggIB
+    AFNHFGPDxY966fz0dxDFFSfeo47y7XQZMK9xAwH73cQoSeqx+IMxzgM8nfJQ9XMN
+    PeLwVRZ7pvRee2ZhUPglBSTHnW2rvfmLBOO9xyKZxRsCkoFxuHH9xfM7bFWb96R6
+    fGrOdEZDB3yj00T+tkubwqt+/dUhQUj8juwyPs55WMb/0BIbapaoQ6QOP13CaXDV
+    ZmAfsEEIBkNxfq7GTr/z0Rq0B4+9FxAf3Jrsmi/dYoFD/prHsvBDkYw1daoFyp5C
+    tbctvB9wtphnCCynekt8UBvpVKHUU/xaUa09TQTToXjBbV1SZeIOHNG0MNbWa4sz
+    AL/cpXdq1EAxiTeAVT9XhCwhe/xJvFZIWuFLmW3J+ZxrOUCKieCYpTqBY2tBkkDY
+    //egic787yTR6zxqQNSzvNU5LhzrN7lu+KHGM06T35+HvpzgPPiRCzsxO62p63op
+    mq04K31yYZgLiqeAj5W+rioRGJNn4TXJpH9KIrzmGM7lVWLYWMAKeZU4r1lDUdcu
+    7jsBH8BRJWJeVK3xVw2HB3lk7Xn0WrR92adeYQ3f0vKbMIAVUnSJ3yCKJ4NMFSki
+    j78nx2mi/G0RhUPGZ9hhLXQKj9BtbpEnwpbGWtf0ShtVOxD/HKLCr7koBtW9TMPS
+    9K0sJhE5VjsQLkDDu9p3GdRcuLNA/oa7xFvRFtqGFsLj
+    -----END CERTIFICATE-----

apps/message-hub/wb/kustomization.yaml

@@ -3,4 +3,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: message-hub
 resources:
-  - ../base
+  - kafka-cert-configmap.yaml
+  - message-hub.yaml

apps/message-hub/wb/message-hub.yaml

@@ -0,0 +1,209 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: message-hub
+  namespace: message-hub
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      message-hub:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/message-hub:production_24425472
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: message-hub-message-hub
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: message-hub-message-hub
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: kafka-cert-volume
+              mountPath:
+                _default: /usr/local/share/ca-certificates
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: kafka-cert
+
+        envs:
+          - name: WORKER_TIMEOUT
+            value:
+              _default: "60"
+
+          - name: PYTHONPATH
+            value:
+              _default: "src"
+
+          - name: SETTINGS_MAX_RETRIES
+            value:
+              _default: "1"
+
+          - name: SETTINGS_TOPICS
+            value:
+              _default: '{"planning": "pm", "assets": "assets_broadcast", "project_entity": "issues_broadcast"}'
+
+          - name: SETTINGS_PDF_CONVERTER_HOST
+            value:
+              _default: "http://export-project-service.django.svc.cluster.local:8000"
+
+          - name: SAREX_BASE_HOST
+            value:
+              _default: "http://backend-service.pm.svc.cluster.local:8000"
+
+          - name: DB_HOST
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: DB_PORT
+            value:
+              _default: "5432"
+
+          - name: DB_DATABASE
+            value:
+              _default: "pm_db"
+
+          - name: CACHE_HOST
+            value:
+              _default: "redis.pm.svc.cluster.local"
+
+          - name: CACHE_PORT
+            value:
+              _default: "6379"
+
+          - name: CACHE_SSL
+            value:
+              _default: "0"
+
+          - name: KAFKA_HOST
+            value:
+              _default: "wb-prod-kafka-bootstrap.kafka.svc.cluster.local"
+
+          - name: KAFKA_PORT
+            value:
+              _default: "9093"
+
+          - name: KAFKA_SECURITY_PROTOCOL
+            value:
+              _default: "SSL"
+
+          - name: KAFKA_SASL_MECHANISM
+            value:
+              _default: "SCRAM-SHA-512"
+
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: "/usr/local/share/ca-certificates/kafka.crt"
+
+        secretEnvs:
+          - name: KAFKA_USERNAME
+            secretName:
+              _default: "kafka-secret"
+            secretKey: "username"
+
+          - name: KAFKA_PASSWORD
+            secretName:
+              _default: "kafka-secret"
+            secretKey: "password"
+
+          - name: DB_USERNAME
+            secretName:
+              _default: "postgres-pm-secret"
+            secretKey: "username"
+
+          - name: DB_PASSWORD
+            secretName:
+              _default: "postgres-pm-secret"
+            secretKey: "password"
+
+          - name: S3_LOGIN
+            secretName:
+              _default: "s3-secret"
+            secretKey: "username"
+
+          - name: S3_PASSWORD
+            secretName:
+              _default: "s3-secret"
+            secretKey: "password"
+
+          - name: S3_BUCKET
+            secretName:
+              _default: "s3-secret"
+            secretKey: "bucket"
+
+          - name: S3_HOST
+            secretName:
+              _default: "s3-secret"
+            secretKey: "host"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/pm/wb/backend-configmap.yaml

@@ -0,0 +1,30 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: backend-configmap
+  namespace: pm
+data:
+  uwsgi.ini: |
+    [uwsgi]
+    log-format = {"time": "%(time)", "method": "%(method)", "uri": "%(uri)", "status": "%(status)", "size": "%(size)", "addr": "%(addr)", "user": "%(user)", "proto": "%(proto)", "user_agent": "%(uagent)", "referer": "%(referer)", "trace_id": "%(trace_id)", "span_id": "%(span_id)"}
+    module                 = config.wsgi:application
+    DJANGO_SETTINGS_MODULE = config.settings.base
+    http                   = 0.0.0.0:8000
+    processes              = 8
+    master                 = true
+    vacuum                 = true
+    enable-threads         = true
+    buffer-size            = 65535
+    stats                  = :3031
+    stats-http             = true
+    memory-report          = true
+    lazy-apps              = true
+    listen                 = 1024
+    disable-write-exception= 0
+    harakiri               = 300
+    socket-timeout         = 300
+    chunked-input-timeout  = 300
+    http-timeout           = 300
+    worker-reload-mercy    = 240
+    mule-reload-mercy      = 240

apps/pm/wb/backend.yaml

@@ -0,0 +1,153 @@
+---
+# ENV-файл env-file (secret sarex-env, ключ .env) содержит остальные секреты
+# приложения (DB/S3/Kafka и т.п.) — в дампе кластера Secret'ы не выгружены,
+# сам файл-секрет должен уже существовать в неймспейсе pm.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: pm
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      backend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/pm-backend:production_c54c2123
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: backend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: backend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: uwsgi-configmap
+              mountPath:
+                _default: /opt/sarex/uwsgi.ini
+              subPath:
+                _default: uwsgi.ini
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: backend-configmap
+                items:
+                  - key: uwsgi.ini
+                    path:
+                      _default: uwsgi.ini
+
+            - name: env-file
+              mountPath:
+                _default: /opt/sarex/.env
+              subPath:
+                _default: .env
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: sarex-env
+                items:
+                  - key: .env
+                    path:
+                      _default: .env
+
+            - name: kafka-cert-volume
+              mountPath:
+                _default: /usr/local/share/ca-certificates
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: kafka-cert
+
+        envs:
+          - name: USERS_INTERNAL_HOST
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+          - name: RESOURCES_INTERNAL_HOST
+            value:
+              _default: "http://resources-service.resources.svc.cluster.local:8000"
+
+          - name: EAV_HOST
+            value:
+              _default: "http://eav-service.eav.svc.cluster.local:8000"
+
+          - name: EAV_API_PREFIX
+            value:
+              _default: "/api/v0"
+
+          - name: EAV_API_PREFIX_V1
+            value:
+              _default: "/api/v1"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/pm/wb/celery.yaml

@@ -0,0 +1,146 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: celery
+  namespace: pm
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      celery:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/pm-backend:production_c54c2123
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: celery
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          command:
+            _default: ["celery", "-A", "config", "worker", "-B", "-l", "info", "-E", "-Q", "pm", "-n", "default_worker.%h", "--concurrency=2"]
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: false
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: uwsgi-configmap
+              mountPath:
+                _default: /opt/sarex/uwsgi.ini
+              subPath:
+                _default: uwsgi.ini
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: backend-configmap
+                items:
+                  - key: uwsgi.ini
+                    path:
+                      _default: uwsgi.ini
+
+            - name: env-file
+              mountPath:
+                _default: /opt/sarex/.env
+              subPath:
+                _default: .env
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: sarex-env
+                items:
+                  - key: .env
+                    path:
+                      _default: .env
+
+            - name: kafka-cert-volume
+              mountPath:
+                _default: /usr/local/share/ca-certificates
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: kafka-cert
+
+        envs:
+          - name: PLANNING_HOST
+            value:
+              _default: "http://backend-service.pm.svc.cluster.local:8000/api/pm/msp"
+
+          - name: PLANNING_USE
+            value:
+              _default: "True"
+
+          - name: USERS_INTERNAL_HOST
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+          - name: RESOURCES_INTERNAL_HOST
+            value:
+              _default: "http://resources-service.resources.svc.cluster.local:8000"
+
+          - name: EAV_HOST
+            value:
+              _default: "http://eav-service.eav.svc.cluster.local:8000"
+
+          - name: EAV_API_PREFIX
+            value:
+              _default: "/api/v0"
+
+          - name: EAV_API_PREFIX_V1
+            value:
+              _default: "/api/v1"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/pm/wb/kafka-cert-configmap.yaml

@@ -0,0 +1,38 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kafka-cert
+  namespace: pm
+data:
+  kafka.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIIFLTCCAxWgAwIBAgIUYDZPxGRsr7IiqHEmfd07QTQlOKYwDQYJKoZIhvcNAQEN
+    BQAwLTETMBEGA1UECgwKaW8uc3RyaW16aTEWMBQGA1UEAwwNY2x1c3Rlci1jYSB2
+    MDAeFw0yNTEyMTYxNDM0NTVaFw0yNjEyMTYxNDM0NTVaMC0xEzARBgNVBAoMCmlv
+    LnN0cmltemkxFjAUBgNVBAMMDWNsdXN0ZXItY2EgdjAwggIiMA0GCSqGSIb3DQEB
+    AQUAA4ICDwAwggIKAoICAQCfzDZhEzw2pbU5Xpu8OzD+3iQG+DVjU8PQWWQEF27h
+    yjohDkUr3zCZtW7xMKWKUNxBgrKsfe4TDOQN8cij3cS9sy0So+UhMeF7Bq9PU1Yd
+    bmTRq8q1PiuNUkiCGJ5wrb3+NZvVxZLJUIFgiealsRw80MgMWWSzy0I35T2Edn/a
+    DU4jhlgQxyzQ621+oGP0n28gCjmm6pCq2tkj/Z8WTdu1gOWyRdK02a2uE2Ts2nLa
+    Di32GaZrIbIuD/WUd6Ek66uCeJvh2CT7s+SqgtMbtT7gibUuPQ3hk1VGQsjy22l3
+    hUNpLu86nrwbuf21mY55KnLOcaVq1ag1TpIIKfZAL/KWFCGZ6H6kwEIbCAL0Hei7
+    cJ2Wm2/qlzKUeU869M7YybZAfXl/t6XT4QgFgje+42N980vy5A4GhWi1Z7lPqqOe
+    jPGBstkRZybKz1sTk87+oJx82iQU/ozVmzjSEK1SoYRNbvug8PNpxmPoPnJ2flgG
+    t2q2+2ZQP3f1aAHVcZ3U5+hWlRmKPXzjrJv7gnhuvqJl7OwB50y+yWiVfZ9xrYl2
+    EpX+yHuFFK+9NnB5taUK8Fz+hQaLU8J4q7P0bRqkoI+LdcEErjuDT/eI2d5+Ql8K
+    /JkV823hX2WNB9bdaQ24BelVUbsxGpR7ms6KWrM11kHnbzUlEM+AxZES6F7Qbr55
+    TwIDAQABo0UwQzAdBgNVHQ4EFgQUM7hshx7e9TFEN82Pf446aBrJUA4wEgYDVR0T
+    AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQENBQADggIB
+    AFNHFGPDxY966fz0dxDFFSfeo47y7XQZMK9xAwH73cQoSeqx+IMxzgM8nfJQ9XMN
+    PeLwVRZ7pvRee2ZhUPglBSTHnW2rvfmLBOO9xyKZxRsCkoFxuHH9xfM7bFWb96R6
+    fGrOdEZDB3yj00T+tkubwqt+/dUhQUj8juwyPs55WMb/0BIbapaoQ6QOP13CaXDV
+    ZmAfsEEIBkNxfq7GTr/z0Rq0B4+9FxAf3Jrsmi/dYoFD/prHsvBDkYw1daoFyp5C
+    tbctvB9wtphnCCynekt8UBvpVKHUU/xaUa09TQTToXjBbV1SZeIOHNG0MNbWa4sz
+    AL/cpXdq1EAxiTeAVT9XhCwhe/xJvFZIWuFLmW3J+ZxrOUCKieCYpTqBY2tBkkDY
+    //egic787yTR6zxqQNSzvNU5LhzrN7lu+KHGM06T35+HvpzgPPiRCzsxO62p63op
+    mq04K31yYZgLiqeAj5W+rioRGJNn4TXJpH9KIrzmGM7lVWLYWMAKeZU4r1lDUdcu
+    7jsBH8BRJWJeVK3xVw2HB3lk7Xn0WrR92adeYQ3f0vKbMIAVUnSJ3yCKJ4NMFSki
+    j78nx2mi/G0RhUPGZ9hhLXQKj9BtbpEnwpbGWtf0ShtVOxD/HKLCr7koBtW9TMPS
+    9K0sJhE5VjsQLkDDu9p3GdRcuLNA/oa7xFvRFtqGFsLj
+    -----END CERTIFICATE-----

apps/pm/wb/kustomization.yaml

@@ -3,4 +3,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: pm
 resources:
-  - ../base
+  - backend-configmap.yaml
+  - kafka-cert-configmap.yaml
+  - backend.yaml
+  - celery.yaml
+  - redis.yaml

apps/pm/wb/redis.yaml

@@ -0,0 +1,88 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: redis
+  namespace: pm
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      redis:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/redis:latest
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: redis
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 6379
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: redis
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 6379
+
+          targetPort:
+            _default: 6379
+
+          portName:
+            _default: tcp
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/processing/wb/engine-low.yaml

@@ -0,0 +1,434 @@
+---
+# serviceAccountName в дампе: workflows-backend-sa (нужен для
+# ENABLE_KUBERNETES_EXECUTOR=1). Role/RoleBinding под этот SA в дампе не было,
+# их нужно завести отдельно, если ещё не существуют в неймспейсе workflow.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: engine-low
+  namespace: workflow
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      engine-low:
+        enabled: true
+
+        serviceAccount:
+          enabled:
+            _default: false
+          name:
+            _default: workflows-backend-sa
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/workflows-engine:prod_b6e15fda
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: engine-low
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8080
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: false
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: yc-s3
+              mountPath:
+                _default: /etc/sarex/yc-s3
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: yc-s3
+
+            - name: django-auth
+              mountPath:
+                _default: /etc/django-auth
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: django-auth
+
+            - name: smtp-secret
+              mountPath:
+                _default: /etc/smtp-secret
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: smtp-secret
+
+        envs:
+          - name: RABBITMQ_HOST
+            value:
+              _default: "rabbitmq-service.workflow.svc.cluster.local"
+
+          - name: RABBITMQ_PORT
+            value:
+              _default: "5672/api"
+
+          - name: POSTGRES_ADDRESS
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: POSTGRES_PORT
+            value:
+              _default: "5432"
+
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "20"
+
+          - name: ENVIRONMENT
+            value:
+              _default: "prod"
+
+          - name: WORKFLOWS_SENTRY_DSN
+            value:
+              _default: "https://866b532efdbb4764a7551b76231232fc@o279218.ingest.sentry.io/543123"
+
+          - name: WORKFLOWS_SENTRY_DEBUG
+            value:
+              _default: "0"
+
+          - name: API_ADDRESS
+            value:
+              _default: "0.0.0.0:8000"
+
+          - name: DJANGO_HOST
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+          - name: S3_SERVICE_ACCOUNT
+            value:
+              _default: "/etc/sarex/yc-s3/yc-s3-service-account.json"
+
+          - name: BIM_API_V2_DB
+            value:
+              _default: "/etc/sarex/bim-api-v2-db-prod.json"
+
+          - name: PDM_API_DB
+            value:
+              _default: "/etc/pdm/pdm-api-db-prod.json"
+
+          - name: WORKSPACE_API_DB
+            value:
+              _default: "/etc/ws/ws-api-db-prod.json"
+
+          - name: ISSUE_API_DB
+            value:
+              _default: "/etc/issues/issue-api-db-prod.json"
+
+          - name: MAILGUN
+            value:
+              _default: "/etc/mailgun-secret/env.json"
+
+          - name: SMTP
+            value:
+              _default: "/etc/smtp-secret/smtp.json"
+
+          - name: INTERNAL_PDM_URL
+            value:
+              _default: "http://documentations-api.documentations.svc.cluster.local:8080"
+
+          - name: INTERNAL_FILESTREAM_URL
+            value:
+              _default: "http://documentations-filestream.documentations.svc.cluster.local:8080"
+
+          - name: EXTERNAL_PDM_URL
+            value:
+              _default: "http://documentations-api.documentations.svc.cluster.local:8080"
+
+          - name: EXTERNAL_FILESTREAM_URL
+            value:
+              _default: "http://documentations-filestream-service.documentations.svc.cluster.local:8080"
+
+          - name: RESOURCES_API_INTERNAL_HOST
+            value:
+              _default: "http://resources-service.resources.svc.cluster.local:8000"
+
+          - name: ENABLE_SQL_QUERY
+            value:
+              _default: "0"
+
+          - name: ENABLE_S3_STORAGE
+            value:
+              _default: "1"
+
+          - name: ENABLE_S3V2_STORAGE
+            value:
+              _default: "1"
+
+          - name: ENABLE_PDM_STORAGE
+            value:
+              _default: "1"
+
+          - name: ENABLE_SMTP
+            value:
+              _default: "1"
+
+          - name: ENABLE_URL_STORAGE
+            value:
+              _default: "1"
+
+          - name: ENABLE_SRX_TMP
+            value:
+              _default: "1"
+
+          - name: ENABLE_BIM_API_V2_DB
+            value:
+              _default: "1"
+
+          - name: ENABLE_WORKSPACE_API_DB
+            value:
+              _default: "1"
+
+          - name: ENABLE_ISSUE_API_DB
+            value:
+              _default: "1"
+
+          - name: ENABLE_RESOURCES_API
+            value:
+              _default: "1"
+
+          - name: ENABLE_PDM_API_DB
+            value:
+              _default: "1"
+
+          - name: ENABLE_COMPARISONS_API_DB
+            value:
+              _default: "1"
+
+          - name: ENABLE_MAIL_GUN
+            value:
+              _default: "1"
+
+          - name: ENABLE_AMQP_EXECUTOR
+            value:
+              _default: "0"
+
+          - name: ENABLE_KUBERNETES_EXECUTOR
+            value:
+              _default: "1"
+
+          - name: MAX_WORKFLOWS_LIMIT
+            value:
+              _default: "5"
+
+          - name: CPU_COUNT
+            value:
+              _default: "1"
+
+          - name: MEMORY_GI
+            value:
+              _default: "1"
+
+          - name: CPU_COUNT_LOW_RESOURCES
+            value:
+              _default: "1"
+
+          - name: MEMORY_GI_LOW_RESOURCES
+            value:
+              _default: "1"
+
+          - name: CPU_COUNT_HIGH_MEM
+            value:
+              _default: "1"
+
+          - name: MEMORY_GI_HIGH_MEM
+            value:
+              _default: "1"
+
+          - name: ENABLE_TOLERATION
+            value:
+              _default: "1"
+
+          - name: COUNT_RUNNING_WORKERS
+            value:
+              _default: "1"
+
+          - name: COUNT_CANCELING_WORKERS
+            value:
+              _default: "1"
+
+          - name: COUNT_HANDLE_JOB_WORKERS
+            value:
+              _default: "1"
+
+          - name: BIM_API_DEBUG
+            value:
+              _default: "0"
+
+          - name: BIM_API_V2_DEBUG
+            value:
+              _default: "0"
+
+          - name: PDM_API_DEBUG
+            value:
+              _default: "0"
+
+          - name: COMPARISONS_API_DEBUG
+            value:
+              _default: "0"
+
+          - name: WORKSPACE_API_DEBUG
+            value:
+              _default: "0"
+
+          - name: JOBS_NAMESPACE
+            value:
+              _default: "workflow"
+
+          - name: ISSUE_API_DEBUG
+            value:
+              _default: "0"
+
+          - name: TOLERATION_KEY
+            value:
+              _default: "dedicated"
+
+          - name: TOLERATION_VALUE
+            value:
+              _default: "processing-light"
+
+          - name: TOLERATION_KEY_HIGH_MEM
+            value:
+              _default: "dedicated"
+
+          - name: TOLERATION_VALUE_HIGH_MEM
+            value:
+              _default: "processing-light"
+
+          - name: TOLERATION_KEY_PERSISTENT
+            value:
+              _default: "dedicated"
+
+          - name: TOLERATION_VALUE_PERSISTENT
+            value:
+              _default: "processing-light"
+
+          - name: RABBITMQ_CREATE_EXCHANGE
+            value:
+              _default: "autodesk.inputMessage"
+
+          - name: RABBITMQ_CANCEL_EXCHANGE
+            value:
+              _default: "autodesk.cancelMessage"
+
+          - name: RABBITMQ_CREATE_ROUTING_KEY
+            value:
+              _default: "converting"
+
+          - name: RABBITMQ_CANCEL_TOPIC
+            value:
+              _default: "cancel"
+
+          - name: RABBITMQ_COMPLETENESS_EXCHANGE
+            value:
+              _default: "autodesk.outputMessage"
+
+          - name: RABBITMQ_COMPLETENESS_TOPIC
+            value:
+              _default: "output_navis"
+
+          - name: CONTROL_PLANE_PERIOD
+            value:
+              _default: "10s"
+
+          - name: WORKFLOW_PRIORITY
+            value:
+              _default: "low"
+
+          - name: DEFAULT_TOLERATION_KEY
+            value:
+              _default: "dedicated"
+
+          - name: DEFAULT_TOLERATION_VALUE
+            value:
+              _default: "processing-light"
+
+          - name: DEFAULT_NODE_SELECTOR_KEY
+            value:
+              _default: "dedicated"
+
+          - name: DEFAULT_NODE_SELECTOR_VALUE
+            value:
+              _default: "processing-light"
+
+        secretEnvs:
+          - name: RABBITMQ_USER
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "username"
+
+          - name: RABBITMQ_PASS
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "password"
+
+          - name: POSTGRES_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: POSTGRES_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: POSTGRES_DB
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "database"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/processing/wb/engine.yaml

@@ -0,0 +1,427 @@
+---
+# serviceAccountName в дампе: workflows-backend-sa (нужен для
+# ENABLE_KUBERNETES_EXECUTOR=1 — engine создаёт Job'ы). Role/RoleBinding под
+# этот SA в дампе не было (экспортировались только deployments/services/configmaps),
+# их нужно завести отдельно, если ещё не существуют в неймспейсе workflow.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: engine
+  namespace: workflow
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      engine:
+        enabled: true
+
+        serviceAccount:
+          enabled:
+            _default: false
+          name:
+            _default: workflows-backend-sa
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/workflows-engine:prod_b6e15fda
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: engine
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8080
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: false
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: yc-s3
+              mountPath:
+                _default: /etc/sarex/yc-s3
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: yc-s3
+
+            - name: django-auth
+              mountPath:
+                _default: /etc/django-auth
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: django-auth
+
+            - name: smtp-secret
+              mountPath:
+                _default: /etc/smtp-secret
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: smtp-secret
+
+        envs:
+          - name: TOLERATION_KEY
+            value:
+              _default: "dedicated"
+
+          - name: DEFAULT_TOLERATION_KEY
+            value:
+              _default: "dedicated"
+
+          - name: DEFAULT_TOLERATION_VALUE
+            value:
+              _default: "processing-light"
+
+          - name: TOLERATION_VALUE
+            value:
+              _default: "processing-light"
+
+          - name: TOLERATION_KEY_HIGH_MEM
+            value:
+              _default: "dedicated"
+
+          - name: TOLERATION_VALUE_HIGH_MEM
+            value:
+              _default: "processing-light"
+
+          - name: TOLERATION_KEY_PERSISTENT
+            value:
+              _default: "dedicated"
+
+          - name: TOLERATION_VALUE_PERSISTENT
+            value:
+              _default: "processing-light"
+
+          - name: RABBITMQ_HOST
+            value:
+              _default: "rabbitmq.rabbitmq.svc.cluster.local"
+
+          - name: RABBITMQ_PORT
+            value:
+              _default: "5672/cad"
+
+          - name: POSTGRES_ADDRESS
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: POSTGRES_PORT
+            value:
+              _default: "5432"
+
+          - name: WORKFLOWS_SENTRY_DSN
+            value:
+              _default: "https://866b532efdbb4764a7551b76231232fc@o279218.ingest.sentry.io/543123"
+
+          - name: WORKFLOWS_SENTRY_DEBUG
+            value:
+              _default: "0"
+
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "20"
+
+          - name: ENABLE_SMTP
+            value:
+              _default: "1"
+
+          - name: SMTP
+            value:
+              _default: "/etc/smtp-secret/smtp.json"
+
+          - name: ENVIRONMENT
+            value:
+              _default: "prod"
+
+          - name: API_ADDRESS
+            value:
+              _default: "0.0.0.0:8000"
+
+          - name: DJANGO_HOST
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+          - name: S3_SERVICE_ACCOUNT
+            value:
+              _default: "/etc/sarex/yc-s3/yc-s3-service-account.json"
+
+          - name: BIM_API_V2_DB
+            value:
+              _default: "/etc/sarex/bim-api-v2-db-prod.json"
+
+          - name: PDM_API_DB
+            value:
+              _default: "/etc/pdm/pdm-api-db-prod.json"
+
+          - name: WORKSPACE_API_DB
+            value:
+              _default: "/etc/ws/ws-api-db-prod.json"
+
+          - name: ISSUE_API_DB
+            value:
+              _default: "/etc/issues/issue-api-db-prod.json"
+
+          - name: MAILGUN
+            value:
+              _default: "/etc/mailgun-secret/env.json"
+
+          - name: INTERNAL_PDM_URL
+            value:
+              _default: "http://documentations-api.documentations.svc.cluster.local:8080"
+
+          - name: INTERNAL_FILESTREAM_URL
+            value:
+              _default: "http://documentations-filestream.documentations.svc.cluster.local:8080"
+
+          - name: EXTERNAL_PDM_URL
+            value:
+              _default: "http://documentations-api.documentations.svc.cluster.local:8080"
+
+          - name: EXTERNAL_FILESTREAM_URL
+            value:
+              _default: "http://documentations-filestream-service.documentations.svc.cluster.local:8080"
+
+          - name: RESOURCES_API_INTERNAL_HOST
+            value:
+              _default: "http://resources-service.resources.svc.cluster.local:8000"
+
+          - name: ENABLE_SQL_QUERY
+            value:
+              _default: "0"
+
+          - name: ENABLE_S3_STORAGE
+            value:
+              _default: "1"
+
+          - name: ENABLE_S3V2_STORAGE
+            value:
+              _default: "1"
+
+          - name: ENABLE_PDM_STORAGE
+            value:
+              _default: "1"
+
+          - name: ENABLE_URL_STORAGE
+            value:
+              _default: "1"
+
+          - name: ENABLE_SRX_TMP
+            value:
+              _default: "1"
+
+          - name: ENABLE_BIM_API_V2_DB
+            value:
+              _default: "1"
+
+          - name: ENABLE_WORKSPACE_API_DB
+            value:
+              _default: "1"
+
+          - name: ENABLE_ISSUE_API_DB
+            value:
+              _default: "1"
+
+          - name: ENABLE_RESOURCES_API
+            value:
+              _default: "1"
+
+          - name: ENABLE_PDM_API_DB
+            value:
+              _default: "1"
+
+          - name: ENABLE_COMPARISONS_API_DB
+            value:
+              _default: "1"
+
+          - name: ENABLE_MAIL_GUN
+            value:
+              _default: "0"
+
+          - name: ENABLE_AMQP_EXECUTOR
+            value:
+              _default: "1"
+
+          - name: ENABLE_KUBERNETES_EXECUTOR
+            value:
+              _default: "1"
+
+          - name: MAX_WORKFLOWS_LIMIT
+            value:
+              _default: "5"
+
+          - name: CPU_COUNT
+            value:
+              _default: "1"
+
+          - name: MEMORY_GI
+            value:
+              _default: "1"
+
+          - name: CPU_COUNT_LOW_RESOURCES
+            value:
+              _default: "1"
+
+          - name: MEMORY_GI_LOW_RESOURCES
+            value:
+              _default: "1"
+
+          - name: CPU_COUNT_HIGH_MEM
+            value:
+              _default: "1"
+
+          - name: MEMORY_GI_HIGH_MEM
+            value:
+              _default: "1"
+
+          - name: ENABLE_TOLERATION
+            value:
+              _default: "1"
+
+          - name: COUNT_RUNNING_WORKERS
+            value:
+              _default: "1"
+
+          - name: COUNT_CANCELING_WORKERS
+            value:
+              _default: "1"
+
+          - name: COUNT_HANDLE_JOB_WORKERS
+            value:
+              _default: "1"
+
+          - name: BIM_API_DEBUG
+            value:
+              _default: "0"
+
+          - name: BIM_API_V2_DEBUG
+            value:
+              _default: "0"
+
+          - name: PDM_API_DEBUG
+            value:
+              _default: "0"
+
+          - name: COMPARISONS_API_DEBUG
+            value:
+              _default: "0"
+
+          - name: WORKSPACE_API_DEBUG
+            value:
+              _default: "0"
+
+          - name: JOBS_NAMESPACE
+            value:
+              _default: "workflow"
+
+          - name: ISSUE_API_DEBUG
+            value:
+              _default: "0"
+
+          - name: RABBITMQ_CREATE_EXCHANGE
+            value:
+              _default: "autodesk.inputMessage"
+
+          - name: RABBITMQ_CANCEL_EXCHANGE
+            value:
+              _default: "autodesk.cancelMessage"
+
+          - name: RABBITMQ_CREATE_ROUTING_KEY
+            value:
+              _default: "converting"
+
+          - name: RABBITMQ_CANCEL_TOPIC
+            value:
+              _default: "cancel"
+
+          - name: RABBITMQ_COMPLETENESS_EXCHANGE
+            value:
+              _default: "autodesk.outputMessage"
+
+          - name: RABBITMQ_COMPLETENESS_TOPIC
+            value:
+              _default: "output"
+
+          - name: CONTROL_PLANE_PERIOD
+            value:
+              _default: "10s"
+
+          - name: WORKFLOW_PRIORITY
+            value:
+              _default: "high"
+
+        secretEnvs:
+          - name: RABBITMQ_USER
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "username"
+
+          - name: RABBITMQ_PASS
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "password"
+
+          - name: POSTGRES_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: POSTGRES_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: POSTGRES_DB
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "database"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/processing/wb/frontend.yaml

@@ -0,0 +1,88 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: workflow
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      frontend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/workflows-frontend:wb_ebc15427
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: frontend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8080
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: frontend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8080
+
+          targetPort:
+            _default: 8080
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/processing/wb/kustomization.yaml

@@ -1,13 +1,10 @@
 ---
-# В wb приложение processing разворачивается в неймспейс workflow (не
+# processing разворачивается в wb в неймспейс workflow (не processing).
-# processing, как в base/ugmk).
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: workflow
 resources:
-  - ../base
+  - engine.yaml
-patches:
+  - engine-low.yaml
-  - path: rbac.yaml
+  - frontend.yaml
-    target:
+  - workflows-api.yaml
-      kind: RoleBinding
-      name: processing-jobs

apps/processing/wb/rbac.yaml

@@ -1,19 +0,0 @@
----
-# kustomize сам переименовывает Namespace/Role/RoleBinding в workflow через
-# поле namespace: в kustomization.yaml, но НЕ подставляет новый неймспейс в
-# subjects[].namespace у RoleBinding (это не namespaced-поле верхнего уровня) —
-# поэтому ServiceAccount-субъект приходится поправить руками, иначе биндинг
-# будет ссылаться на несуществующий processing-vault в ns processing.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: processing-jobs
-  namespace: processing
-subjects:
-  - kind: ServiceAccount
-    name: processing-vault
-    namespace: workflow
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: processing-jobs

apps/processing/wb/workflows-api.yaml

@@ -0,0 +1,142 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: workflows-api
+  namespace: workflow
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      workflows-api:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/workflows-api:prod_e963403f
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: workflows-api
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8080
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: workflows-api-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8080
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        envs:
+          - name: POSTGRES_ADDRESS
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: POSTGRES_PORT
+            value:
+              _default: "5432"
+
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "3"
+
+          - name: HTTP_HOST
+            value:
+              _default: "0.0.0.0:8080"
+
+          - name: DJANGO_HOST
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+          - name: S3_SERVICE_ACCOUNT
+            value:
+              _default: "/etc/sarex/yc-s3/yc-s3-service-account.json"
+
+          - name: ENABLE_SQL_QUERY
+            value:
+              _default: "0"
+
+          - name: POSTGRES_SSL_USE
+            value:
+              _default: "0"
+
+        secretEnvs:
+          - name: POSTGRES_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: POSTGRES_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: POSTGRES_DB
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "database"
+
+          - name: PUBLIC_KEY
+            secretName:
+              _default: "public-key"
+            secretKey: "key"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/projects/wb/frontend.yaml

@@ -0,0 +1,95 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: projects-frontend-static
+  namespace: projects
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      projects-frontend-static:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/project-frontend-app:wb_fd49eb19
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: projects-frontend-static
+
+          replicaCount:
+            _default: 2
+
+          port:
+            _default: 80
+
+          resources:
+            requests:
+              cpu:
+                _default: 100m
+              memory:
+                _default: 100Mi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: projects-frontend-static-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/projects/wb/kustomization.yaml

@@ -3,4 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: projects
 resources:
-  - ../base
+  - frontend.yaml

apps/reviews/wb/frontend.yaml

@@ -0,0 +1,95 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: reviews
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      frontend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/reviews-frontend:contour_3a66be35
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: frontend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          resources:
+            requests:
+              cpu:
+                _default: 100m
+              memory:
+                _default: 100Mi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: frontend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/reviews/wb/kustomization.yaml

@@ -3,4 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: reviews
 resources:
-  - ../base
+  - frontend.yaml

apps/rfi/wb/backend.yaml

@@ -0,0 +1,203 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: rfi-backend-api
+  namespace: rfi
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      api:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/rfi-backend:production_d1e2e80d
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: rfi-backend-api
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          resources:
+            requests:
+              cpu:
+                _default: "1"
+              memory:
+                _default: 1Gi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: rfi-backend-api-svc
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        envs:
+          - name: JWT_AUTH_ENABLE
+            value:
+              _default: "True"
+
+          - name: NOTIFICATIONS_ENABLE
+            value:
+              _default: "false"
+
+          - name: NOTIFICATIONS_EMAIL_FROM
+            value:
+              _default: "hello@sarex.io"
+
+          - name: NOTIFICATIONS_SERVICE_URL
+            value:
+              _default: "https://srx.wb.ru/rfi"
+
+          - name: SAREX_BACKEND_URL
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+          - name: EAV_URL
+            value:
+              _default: "http://eav-service.eav.svc.cluster.local:8000"
+
+          - name: GATEWAY_URL
+            value:
+              _default: "http://pdm-api.documentations.svc.cluster.local:8080"
+
+          - name: RABBITMQ_PORT
+            value:
+              _default: "5672"
+
+          - name: RABBITMQ_HOST
+            value:
+              _default: "rabbitmq.rabbitmq.svc.cluster.local"
+
+        secretEnvs:
+          - name: DJANGO_SECRET_KEY
+            secretName:
+              _default: "django-secret"
+            secretKey: "django_secret_key"
+
+          - name: DB_HOST
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "host"
+
+          - name: DB_PORT
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "port"
+
+          - name: DB_NAME
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "dbname"
+
+          - name: DB_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "user"
+
+          - name: DB_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: SAREX_BACKEND_AUTH
+            secretName:
+              _default: "django-secret"
+            secretKey: "token"
+
+          - name: YC_S3_ACCESS_KEY_ID
+            secretName:
+              _default: "s3-secret"
+            secretKey: "key_id"
+
+          - name: YC_S3_SECRET_ACCESS_KEY
+            secretName:
+              _default: "s3-secret"
+            secretKey: "access_key"
+
+          - name: YC_S3_BUCKET_NAME
+            secretName:
+              _default: "s3-secret"
+            secretKey: "storage_bucket_name"
+
+          - name: YC_S3_ENDPOINT_URL
+            secretName:
+              _default: "s3-secret"
+            secretKey: "endpoint_url"
+
+          - name: RABBITMQ_VHOST
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "vhost"
+
+          - name: RABBITMQ_USERNAME
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "username"
+
+          - name: RABBITMQ_PASSWORD
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "password"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/rfi/wb/celery.yaml

@@ -0,0 +1,193 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: celery
+  namespace: rfi
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      celery:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/rfi-backend:production_d1e2e80d
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: celery
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          command:
+            _default: ["uv"]
+          args:
+            _default: ["run", "celery", "-A", "config", "worker", "-l", "info"]
+
+          resources:
+            requests:
+              cpu:
+                _default: "1"
+              memory:
+                _default: 1Gi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: false
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        envs:
+          - name: JWT_AUTH_ENABLE
+            value:
+              _default: "True"
+
+          - name: NOTIFICATIONS_ENABLE
+            value:
+              _default: "false"
+
+          - name: NOTIFICATIONS_EMAIL_FROM
+            value:
+              _default: "hello@sarex.io"
+
+          - name: NOTIFICATIONS_SERVICE_URL
+            value:
+              _default: "https://lk.srx.wb.ru:30443/rfi"
+
+          - name: SAREX_BACKEND_URL
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+          - name: EAV_URL
+            value:
+              _default: "http://eav-service.eav.svc.cluster.local:8000"
+
+          - name: GATEWAY_URL
+            value:
+              _default: "http://pdm-api.documentations.svc.cluster.local:8080"
+
+          - name: RABBITMQ_PORT
+            value:
+              _default: "5672"
+
+          - name: RABBITMQ_HOST
+            value:
+              _default: "rabbitmq.rabbitmq.svc.cluster.local"
+
+        secretEnvs:
+          - name: DJANGO_SECRET_KEY
+            secretName:
+              _default: "django-secret"
+            secretKey: "django_secret_key"
+
+          - name: DB_HOST
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "host"
+
+          - name: DB_PORT
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "port"
+
+          - name: DB_NAME
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "dbname"
+
+          - name: DB_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "user"
+
+          - name: DB_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: SAREX_BACKEND_AUTH
+            secretName:
+              _default: "django-secret"
+            secretKey: "token"
+
+          - name: YC_S3_ACCESS_KEY_ID
+            secretName:
+              _default: "s3-secret"
+            secretKey: "key_id"
+
+          - name: YC_S3_SECRET_ACCESS_KEY
+            secretName:
+              _default: "s3-secret"
+            secretKey: "access_key"
+
+          - name: YC_S3_BUCKET_NAME
+            secretName:
+              _default: "s3-secret"
+            secretKey: "storage_bucket_name"
+
+          - name: YC_S3_ENDPOINT_URL
+            secretName:
+              _default: "s3-secret"
+            secretKey: "endpoint_url"
+
+          - name: RABBITMQ_VHOST
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "vhost"
+
+          - name: RABBITMQ_USERNAME
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "username"
+
+          - name: RABBITMQ_PASSWORD
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "password"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/rfi/wb/frontend.yaml

@@ -0,0 +1,95 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: rfi-frontend
+  namespace: rfi
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      rfi-frontend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/rfi-frontend:production_b827756f_wb
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: rfi-frontend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          resources:
+            requests:
+              cpu:
+                _default: 100m
+              memory:
+                _default: 100Mi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: rfi-frontend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/rfi/wb/kustomization.yaml

@@ -3,4 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: rfi
 resources:
-  - ../base
+  - backend.yaml
+  - celery.yaml
+  - frontend.yaml

apps/subscriptions/wb/backend.yaml

@@ -0,0 +1,203 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: sarex-subscriptions
+  namespace: subscriptions
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      sarex-subscriptions:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/subscriptions:prod_a50928e1
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: sarex-subscriptions
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          resources:
+            requests:
+              cpu:
+                _default: "1"
+              memory:
+                _default: 512Mi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: sarex-subscriptions-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: uwsgi-configmap
+              mountPath:
+                _default: /opt/server/uwsgi.ini
+              subPath:
+                _default: uwsgi.ini
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: uwsgi-configmap
+                items:
+                  - key: uwsgi.ini
+                    path:
+                      _default: uwsgi.ini
+
+            - name: django-configmap
+              mountPath:
+                _default: /server/config/settings/production.py
+              subPath:
+                _default: production.py
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: django-configmap
+                items:
+                  - key: production.py
+                    path:
+                      _default: production.py
+
+        envs:
+          - name: DATABASE_HOST
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: DATABASE_PORT
+            value:
+              _default: "5432"
+
+          - name: DATABASE_NAME
+            value:
+              _default: "subscriptions_db"
+
+          - name: API_ADDRESS
+            value:
+              _default: "8000"
+
+          - name: SYSTEM_LOG_HOST
+            value:
+              _default: "http://api-service.system-log"
+
+          - name: USER_SERVICE_HOST
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+          - name: IS_USE_TELEGRAM
+            value:
+              _default: "false"
+
+          - name: IS_MAILGUN_USE
+            value:
+              _default: "0"
+
+          - name: SMTP_EMAIL_FROM
+            value:
+              _default: "sarex@rwb.ru"
+
+          - name: SMTP_EMAIL_HOST
+            value:
+              _default: "mail.rwb.ru"
+
+          - name: SMTP_EMAIL_PORT
+            value:
+              _default: "465"
+
+        secretEnvs:
+          - name: DATABASE_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: DATABASE_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: YC_S3_ACCESS_KEY_ID
+            secretName:
+              _default: "yc-s3-secret"
+            secretKey: "key_id"
+
+          - name: YC_S3_SECRET_ACCESS_KEY
+            secretName:
+              _default: "yc-s3-secret"
+            secretKey: "access_key"
+
+          - name: YC_S3_BUCKET_NAME
+            secretName:
+              _default: "yc-s3-secret"
+            secretKey: "storage_bucket_name"
+
+          - name: YC_S3_ENDPOINT_URL
+            secretName:
+              _default: "yc-s3-secret"
+            secretKey: "endpoint_url"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/subscriptions/wb/django-configmap.yaml

@@ -0,0 +1,102 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: django-configmap
+  namespace: subscriptions
+data:
+  production.py: |
+    import os
+
+    from .base import *
+
+    # DEBUG SETTINGS START
+    # -----------------------------------------------------------------------------
+    DEBUG = False
+    # -----------------------------------------------------------------------------
+    # DEBUG SETTINGS END
+
+
+    # ALLOWED HOSTS START
+    # -----------------------------------------------------------------------------
+    ALLOWED_HOSTS = ["*"]
+    # -----------------------------------------------------------------------------
+    # ALLOWED HOSTS END
+
+    # DATABASE CONFIGURATION START
+    # ------------------------------------------------------------------------------
+    POSTGRES_DATABASE = os.getenv("DATABASE_NAME")
+    POSTGRES_USER = os.getenv("DATABASE_USER")
+    POSTGRES_PASSWORD = os.getenv("DATABASE_PASSWORD")
+    POSTGRES_HOST = os.getenv("DATABASE_HOST")
+    POSTGRES_PORT = os.getenv("DATABASE_PORT")
+
+    DATABASES = {
+        "default": {
+            "ENGINE": "core.db.backends.postgis",
+            "NAME": POSTGRES_DATABASE,
+            "USER": POSTGRES_USER,
+            "PASSWORD": POSTGRES_PASSWORD,
+            "HOST": POSTGRES_HOST,
+            "PORT": POSTGRES_PORT,
+        }
+    }
+    # DATABASE CONFIGURATION END
+    # ------------------------------------------------------------------------------
+
+
+    CORS_ALLOWED_ORIGINS = [
+        "https://localhost.8000",
+        "https://localhost.8080",
+    ]
+
+    CORS_ALLOW_ALL_ORIGINS = True
+
+    CORS_ALLOW_METHODS = [
+        "DELETE",
+        "GET",
+        "OPTIONS",
+        "PATCH",
+        "POST",
+        "PUT",
+    ]
+
+    # MAILGUN START
+    # ------------------------------------------------------------------------------
+    MAILGUN_BASE_URL = os.getenv("MAILGUN_BASE_URL", default="https://api.mailgun.net/v3/mg.sarex.io")
+    MAILGUN_API_KEY = os.getenv("MAILGUN_API_KEY", default="6383b2d1b300a70b3b686fa1d0f684f8-f45b080f-53294ebe")
+    IS_MAILGUN_USE = os.getenv("IS_MAILGUN_USE", default=False)
+    MAILGUN_EMAIL_FROM = os.getenv("MAILGUN_EMAIL_FROM", default="hello@sarex.io")
+    # ------------------------------------------------------------------------------
+    # MAILGUN END
+
+    # SYSTEM_LOG SERVICE SETTINGS START
+    # -----------------------------------------------------------------------------
+    SYSTEM_LOG_HOST = os.getenv("SYSTEM_LOG_HOST")
+    # -----------------------------------------------------------------------------
+    # SYSTEM_LOG SERVICE SETTINGS END
+
+
+    # TELEGRAM SETTINGS START
+    # -----------------------------------------------------------------------------
+    IS_USE_TELEGRAM = os.getenv("IS_USE_TELEGRAM", default=False)
+    TELEGRAM_BOT_TOKEN = os.getenv("TELEGRAM_BOT_TOKEN", default="6174421650:AAGEicmX0fvDX2683LXiGweWfn1U9UTQHFY")
+    # -----------------------------------------------------------------------------
+    # TELEGRAM SETTINGS END
+
+    # USER SERVICE SETTINGS START
+    # -----------------------------------------------------------------------------
+    USER_SERVICE_HOST = os.getenv("USER_SERVICE_HOST")
+    USER_SERVICE_LOGIN = "hagen013"
+    USER_SERVICE_PASSWORD = "zealot096"
+    # -----------------------------------------------------------------------------
+    # USER SERVICE SETTINGS END
+
+
+    # SMTP
+    # -------------------------------------------
+    SMTP_EMAIL_HOST = os.getenv("SMTP_EMAIL_HOST", default=None)
+    SMTP_EMAIL_PORT = os.getenv("SMTP_EMAIL_PORT", default=None)
+    SMTP_EMAIL_FROM = os.getenv("SMTP_EMAIL_FROM", default="hello@sarex.io")
+    # -------------------------------------------
+    # SMTP

apps/subscriptions/wb/kustomization.yaml

@@ -3,9 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: subscriptions
 resources:
-  - ../base
+  - uwsgi-configmap.yaml
-patches:
+  - django-configmap.yaml
-  - path: patch.yaml
+  - backend.yaml
-    target:
-      kind: Deployment
-      name: sarex-subscriptions

apps/subscriptions/wb/patch.yaml

@@ -1,22 +0,0 @@
----
-# В base MinIO-шаблон зашит на YC_S3_ENDPOINT_URL=https://minio.contour.infra.sarex.tech
-# и YC_S3_BUCKET_NAME=subscriptions — недоступно и не тот бакет для wb.
-# Реальные значения — из terraform 1.yaml (infrastructure.minio.apps.subscriptions
-# для wb): client.endpoint=http://minio-svc.minio.svc.cluster.local:9000,
-# buckets[0].name=sarex-stage-storage-new.
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: sarex-subscriptions
-  namespace: subscriptions
-spec:
-  template:
-    metadata:
-      annotations:
-        vault.hashicorp.com/agent-inject-template-subscriptions-minio: |-
-          {{- with secret "secrets/data/minio/apps/subscriptions" -}}
-          YC_S3_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
-          YC_S3_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
-          YC_S3_BUCKET_NAME=sarex-stage-storage-new
-          YC_S3_ENDPOINT_URL=http://minio-svc.minio.svc.cluster.local:9000
-          {{- end -}}

apps/subscriptions/wb/uwsgi-configmap.yaml

@@ -0,0 +1,22 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: uwsgi-configmap
+  namespace: subscriptions
+data:
+  uwsgi.ini: |
+    [uwsgi]
+    chdir           = /server
+    module          = config.wsgi:application
+    master          = true
+    master-fifo     = /opt/server/uwsgi-backend-server.fifo
+    processes       = 8
+    http            = 0.0.0.0:8000
+    chmod-socket    = 666
+    vacuum          = true
+    harakiri        = 6000
+    buffer-size     = 32768
+
+    static-map = /static=/opt/server/static/
+    static-map = /media=/opt/server/media/

apps/system-log/wb/api.yaml

@@ -0,0 +1,196 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: api
+  namespace: system-log
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      api:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/system-log:prod_6ed1b27e
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: api
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: api-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        envs:
+          - name: KAFKA_ENABLE
+            value:
+              _default: "0"
+
+          - name: KAFKA_BROKERS
+            value:
+              _default: "localhost:9091"
+
+          - name: KAFKA_GROUP
+            value:
+              _default: "system-log-stage"
+
+          - name: KAFKA_CLIENT_ID
+            value:
+              _default: "system-log-stage"
+
+          - name: KAFKA_USE_SSL
+            value:
+              _default: "0"
+
+          - name: KAFKA_ENABLE_LOGGING
+            value:
+              _default: "0"
+
+          - name: KAFKA_TOPIC
+            value:
+              _default: "topic"
+
+          - name: APP_NAME
+            value:
+              _default: "system_log"
+
+          - name: APP_VERSION
+            value:
+              _default: "0.0.1"
+
+          - name: LOG_LEVEL
+            value:
+              _default: "INFO"
+
+          - name: HTTP_HOST
+            value:
+              _default: "0.0.0.0"
+
+          - name: HTTP_PORT
+            value:
+              _default: "8000"
+
+          - name: NAMESPACE
+            value:
+              _default: "system-log"
+
+          - name: POSTGRES_ADDRESS
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: POSTGRES_PORT
+            value:
+              _default: "5432"
+
+          - name: POSTGRES_DB
+            value:
+              _default: "system_log_db"
+
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "3"
+
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+
+          - name: DJANGO_HOST
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+        secretEnvs:
+          - name: POSTGRES_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: POSTGRES_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: KAFKA_USERNAME
+            secretName:
+              _default: "ya-kafka-secret"
+            secretKey: "username"
+
+          - name: KAFKA_PASSWORD
+            secretName:
+              _default: "ya-kafka-secret"
+            secretKey: "password"
+
+          - name: KAFKA_PEM_CERT
+            secretName:
+              _default: "yc-kafka-certificate"
+            secretKey: "certificate"
+
+          - name: KAFKA_PEM_PATH
+            secretName:
+              _default: "yc-kafka-certificate"
+            secretKey: "certificate"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/system-log/wb/kustomization.yaml

@@ -3,4 +3,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: system-log
 resources:
-  - ../base
+  - api.yaml
+  - worker.yaml

apps/system-log/wb/worker.yaml

@@ -0,0 +1,147 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: worker
+  namespace: system-log
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      worker:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/system_log_worker:de6a0147d285afa273e85c0f074c8b6049d03a32
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: worker
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: false
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        envs:
+          - name: APP_NAME
+            value:
+              _default: "system_log"
+
+          - name: APP_VERSION
+            value:
+              _default: "0.0.1"
+
+          - name: LOG_LEVEL
+            value:
+              _default: "INFO"
+
+          - name: HTTP_HOST
+            value:
+              _default: "0.0.0.0"
+
+          - name: HTTP_PORT
+            value:
+              _default: "8000"
+
+          - name: NAMESPACE
+            value:
+              _default: "sarex-system-log"
+
+          - name: DOCUMENTATIONS_URL
+            value:
+              _default: "http://documentations-api.documentations.svc.cluster.local:8080"
+
+          - name: POSTGRES_ADDRESS
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: POSTGRES_PORT
+            value:
+              _default: "5432"
+
+          - name: POSTGRES_DB
+            value:
+              _default: "system_log_db"
+
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "3"
+
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+
+          - name: DJANGO_HOST
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+        secretEnvs:
+          - name: POSTGRES_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: POSTGRES_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: SUPER_USERNAME
+            secretName:
+              _default: "superuser"
+            secretKey: "username"
+
+          - name: SUPER_PASSWORD
+            secretName:
+              _default: "superuser"
+            secretKey: "password"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/transmittal/wb/backend.yaml

@@ -1,26 +1,94 @@
 ---
-# Патч backend для контура wb.
-#
-# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
-# поэтому здесь продублирован весь набор из apps/transmittal/base/backend.yaml.
-#
-# TRANSMITTAL_SERVICE_APP__HOST в base смотрит на тестовый контур
-# (sarex.contour.infra.sarex.tech) — apps/transmittal/base/worker.yaml уже
-# использует правильный для wb https://lk.srx.wb.ru:30443/transmittal,
-# переносим то же значение сюда.
-# TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT в base — заглушка
-# minio.minio.svc.cluster.local:9000. Из terraform 1.yaml
-# (infrastructure.minio.apps.transmittal для wb): client.endpoint=http://10.49.10.90:9000
-# (бакет — уже динамически из vault, buckets[0].name=transmittal).
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
-  name: backend
+  name: transmittal
   namespace: transmittal
+
 spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
   values:
+    global:
+      env: _default
+
     services:
-      backend:
+      transmittal:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/transmittal-api:prod_a9d879ae
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: transmittal
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          resources:
+            requests:
+              cpu:
+                _default: "1"
+              memory:
+                _default: 1Gi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: transmittal-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
         envs:
           - name: TRANSMITTAL_SERVICE_APP__NAME
             value:
@@ -32,7 +100,7 @@ spec:
 
           - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__BASE_URL
             value:
-              _default: "http://backend-svc.flows.svc.cluster.local:80"
+              _default: "http://backend-service.flows.svc.cluster.local:8000"
 
           - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_CONNECTIONS
             value:
@@ -114,14 +182,26 @@ spec:
             value:
               _default: "2"
 
-          - name: TRANSMITTAL_SERVICE_UVICORN__ROOT_PATH
+          - name: TRANSMITTAL_SERVICE_DATABASE__HOST
             value:
-              _default: ""
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: TRANSMITTAL_SERVICE_DATABASE__PORT
+            value:
+              _default: "5432"
+
+          - name: TRANSMITTAL_SERVICE_DATABASE__NAME
+            value:
+              _default: "transmittal_db"
 
           - name: TRANSMITTAL_SERVICE_DATABASE__ENABLE_SSL
             value:
               _default: "false"
 
+          - name: TRANSMITTAL_SERVICE_RABBITMQ__VHOST
+            value:
+              _default: "transmitalls"
+
           - name: TRANSMITTAL_SERVICE_RABBITMQ__HOST
             value:
               _default: "rabbitmq.rabbitmq.svc.cluster.local"
@@ -132,7 +212,7 @@ spec:
 
           - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASE_URL
             value:
-              _default: "http://backend-svc.django.svc.cluster.local:80"
+              _default: "http://backend.django.svc.cluster.local:8000"
 
           - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__MAX_CONNECTIONS
             value:
@@ -148,7 +228,7 @@ spec:
 
           - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__BASE_URL
             value:
-              _default: "http://iam-backend.iam.svc.cluster.local:8000"
+              _default: "http://resources-service.resources.svc.cluster.local:8000"
 
           - name: TRANSMITTAL_SERVICE_RESOURCE_REPOSITORY__MAX_CONNECTIONS
             value:
@@ -164,7 +244,7 @@ spec:
 
           - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__BASE_URL
             value:
-              _default: "http://backend-api-svc.documentations.svc.cluster.local:80"
+              _default: "http://documentations-api.documentations.svc.cluster.local:8080"
 
           - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_CONNECTIONS
             value:
@@ -198,6 +278,10 @@ spec:
             value:
               _default: "true"
 
+          - name: TRANSMITTAL_SERVICE_S3_CLIENT__DEFAULT_BUCKET
+            value:
+              _default: "transmittal-storage"
+
           - name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT
             value:
               _default: "10.49.10.90:9000"
@@ -257,3 +341,59 @@ spec:
           - name: TRANSMITTAL_SERVICE_MAILGUN__EMAIL
             value:
               _default: "hello@wb.io"
+
+        secretEnvs:
+          - name: TRANSMITTAL_SERVICE_DATABASE__USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: TRANSMITTAL_SERVICE_DATABASE__PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: YC-PG-CERTIFICATE
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "certificate"
+
+          - name: TRANSMITTAL_SERVICE_AUTH__PUBLIC_KEY
+            secretName:
+              _default: "public-key"
+            secretKey: "key"
+
+          - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASIC_AUTH_ENCODED
+            secretName:
+              _default: "django-auth"
+            secretKey: "key"
+
+          - name: TRANSMITTAL_SERVICE_S3_CLIENT__ACCESS_KEY
+            secretName:
+              _default: "s3-secret"
+            secretKey: "access_key"
+
+          - name: TRANSMITTAL_SERVICE_S3_CLIENT__SECRET_KEY
+            secretName:
+              _default: "s3-secret"
+            secretKey: "secret_key"
+
+          - name: TRANSMITTAL_SERVICE_RABBITMQ__USER
+            secretName:
+              _default: "rabbitmq-cred"
+            secretKey: "username"
+
+          - name: TRANSMITTAL_SERVICE_RABBITMQ__PASSWORD
+            secretName:
+              _default: "rabbitmq-cred"
+            secretKey: "password"
+
+          - name: TRANSMITTAL_SERVICE_MAILGUN__API_KEY
+            secretName:
+              _default: "mailgun-cred"
+            secretKey: "api_key"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/transmittal/wb/frontend.yaml

@@ -0,0 +1,95 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: transmittal-frontend-static
+  namespace: transmittal
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      transmittal-frontend-static:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/transmittal-frontend:wb_39cc8f57
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: transmittal-frontend-static
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          resources:
+            requests:
+              cpu:
+                _default: 100m
+              memory:
+                _default: 100Mi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: transmittal-frontend-static
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: tcp
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/transmittal/wb/kustomization.yaml

@@ -3,13 +3,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: transmittal
 resources:
-  - ../base
+  - backend.yaml
-patches:
+  - worker.yaml
-  - path: backend.yaml
+  - frontend.yaml
-    target:
-      kind: HelmRelease
-      name: backend
-  - path: worker.yaml
-    target:
-      kind: HelmRelease
-      name: worker

apps/transmittal/wb/worker.yaml

@@ -1,26 +1,94 @@
 ---
-# Патч worker для контура wb.
-#
-# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
-# поэтому здесь продублирован весь набор из apps/transmittal/base/worker.yaml.
-#
-# TRANSMITTAL_SERVICE_APP__HOST в base уже https://lk.srx.wb.ru:30443/transmittal —
-# не трогаем. Меняем только TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT — в base
-# заглушка minio.minio.svc.cluster.local:9000, реальный адрес — из terraform
-# 1.yaml (infrastructure.minio.apps.transmittal для wb): http://10.49.10.90:9000.
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
   name: worker
   namespace: transmittal
+
 spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
   values:
+    global:
+      env: _default
+
     services:
       worker:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/transmittal-api:prod_a9d879ae
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: worker
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          command:
+            _default: ["taskiq", "worker", "--no-parse", "transmittal_service.tasks.broker:broker", "transmittal_service.tasks.transmittal.tasks", "transmittal_service.tasks.email.tasks"]
+
+          resources:
+            requests:
+              cpu:
+                _default: "1"
+              memory:
+                _default: 1Gi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: false
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
         envs:
+          - name: TRANSMITTAL_SERVICE_APP__NAME
+            value:
+              _default: "Transmittal Service"
+
+          - name: TRANSMITTAL_SERVICE_APP__LOG_LEVEL
+            value:
+              _default: "ERROR"
+
           - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__BASE_URL
             value:
-              _default: "http://backend-svc.flows.svc.cluster.local:8000"
+              _default: "http://backend-service.flows.svc.cluster.local:8000"
 
           - name: TRANSMITTAL_SERVICE_FLOWS_REPOSITORY__MAX_CONNECTIONS
             value:
@@ -34,14 +102,6 @@ spec:
             value:
               _default: "30"
 
-          - name: TRANSMITTAL_SERVICE_APP__NAME
-            value:
-              _default: "Transmittal Service"
-
-          - name: TRANSMITTAL_SERVICE_APP__LOG_LEVEL
-            value:
-              _default: "ERROR"
-
           - name: TRANSMITTAL_SERVICE_APP__HOST
             value:
               _default: "https://lk.srx.wb.ru:30443/transmittal"
@@ -110,14 +170,26 @@ spec:
             value:
               _default: "2"
 
-          - name: TRANSMITTAL_SERVICE_UVICORN__ROOT_PATH
+          - name: TRANSMITTAL_SERVICE_DATABASE__HOST
             value:
-              _default: ""
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: TRANSMITTAL_SERVICE_DATABASE__PORT
+            value:
+              _default: "5432"
+
+          - name: TRANSMITTAL_SERVICE_DATABASE__NAME
+            value:
+              _default: "transmittal_db"
 
           - name: TRANSMITTAL_SERVICE_DATABASE__ENABLE_SSL
             value:
               _default: "false"
 
+          - name: TRANSMITTAL_SERVICE_RABBITMQ__VHOST
+            value:
+              _default: "transmitalls"
+
           - name: TRANSMITTAL_SERVICE_RABBITMQ__HOST
             value:
               _default: "rabbitmq.rabbitmq.svc.cluster.local"
@@ -160,7 +232,7 @@ spec:
 
           - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__BASE_URL
             value:
-              _default: "http://backend-api-svc.documentations.svc.cluster.local:80"
+              _default: "http://documentations-api.documentations.svc.cluster.local:8080"
 
           - name: TRANSMITTAL_SERVICE_DOCUMENTATIONS_REPOSITORY__MAX_CONNECTIONS
             value:
@@ -194,6 +266,10 @@ spec:
             value:
               _default: "true"
 
+          - name: TRANSMITTAL_SERVICE_S3_CLIENT__DEFAULT_BUCKET
+            value:
+              _default: "transmittal-storage"
+
           - name: TRANSMITTAL_SERVICE_S3_CLIENT__ENDPOINT
             value:
               _default: "10.49.10.90:9000"
@@ -253,3 +329,59 @@ spec:
           - name: TRANSMITTAL_SERVICE_MAILGUN__EMAIL
             value:
               _default: "hello@wb.io"
+
+        secretEnvs:
+          - name: TRANSMITTAL_SERVICE_DATABASE__USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: TRANSMITTAL_SERVICE_DATABASE__PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: YC-PG-CERTIFICATE
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "certificate"
+
+          - name: TRANSMITTAL_SERVICE_AUTH__PUBLIC_KEY
+            secretName:
+              _default: "public-key"
+            secretKey: "key"
+
+          - name: TRANSMITTAL_SERVICE_SAREX_BACKEND_REPOSITORY__BASIC_AUTH_ENCODED
+            secretName:
+              _default: "django-auth"
+            secretKey: "key"
+
+          - name: TRANSMITTAL_SERVICE_S3_CLIENT__ACCESS_KEY
+            secretName:
+              _default: "s3-secret"
+            secretKey: "access_key"
+
+          - name: TRANSMITTAL_SERVICE_S3_CLIENT__SECRET_KEY
+            secretName:
+              _default: "s3-secret"
+            secretKey: "secret_key"
+
+          - name: TRANSMITTAL_SERVICE_RABBITMQ__USER
+            secretName:
+              _default: "rabbitmq-cred"
+            secretKey: "username"
+
+          - name: TRANSMITTAL_SERVICE_RABBITMQ__PASSWORD
+            secretName:
+              _default: "rabbitmq-cred"
+            secretKey: "password"
+
+          - name: TRANSMITTAL_SERVICE_MAILGUN__API_KEY
+            secretName:
+              _default: "mailgun-cred"
+            secretKey: "api_key"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/workspaces/wb/api.yaml

@@ -0,0 +1,169 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: workspaces-api
+  namespace: workspaces
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      workspaces-api:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/workspaces:prod_4961b1f1
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: workspaces-api
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: workspaces-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        envs:
+          - name: POSTGRES_ADDRESS
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: POSTGRES_PORT
+            value:
+              _default: "5432"
+
+          - name: POSTGRES_DB
+            value:
+              _default: "workspaces_db"
+
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "3"
+
+          - name: BUNDLES_RETRY_COUNT
+            value:
+              _default: "5"
+
+          - name: BUNDLES_NJOBS
+            value:
+              _default: "5"
+
+          - name: API_ADDRESS
+            value:
+              _default: "0.0.0.0:8000"
+
+          - name: NAMESPACE
+            value:
+              _default: "workspaces"
+
+          - name: ENABLE_SQL_QUERY
+            value:
+              _default: "0"
+
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+
+          - name: DOCUMENTATION_HOST
+            value:
+              _default: "http://documentations-api.documentations.svc.cluster.local:8080"
+
+          - name: DOCUMENTATION_LOGGER_FEATURE
+            value:
+              _default: "0"
+
+          - name: DOCUMENTATION_ORIGINATOR
+            value:
+              _default: "prod_ws"
+
+          - name: ENVIRONMENT
+            value:
+              _default: "prod"
+
+          - name: DJANGO_HOST
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+          - name: DJANGO_ORIGINATOR
+            value:
+              _default: "docs_prod"
+
+        secretEnvs:
+          - name: POSTGRES_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: POSTGRES_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: DJANGO_BASIC_AUTH
+            secretName:
+              _default: "django-auth"
+            secretKey: "key"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/workspaces/wb/frontend.yaml

@@ -0,0 +1,88 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: workspaces-v2-frontend-static
+  namespace: workspaces
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      workspaces-v2-frontend-static:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/workspaces-v2-frontend:contour_7f95769f
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: workspaces-v2-frontend-static
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8080
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: workspaces-v2-frontend-static-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8080
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/workspaces/wb/kustomization.yaml

@@ -3,4 +3,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: workspaces
 resources:
-  - ../base
+  - api.yaml
+  - frontend.yaml