Add S3 Proxy apps to yc-ecp: define s3-proxy and s3-proxy-bim HelmReleases with chart, deployment, and service configurations, and include in cluster Kustomization

apps/django/yc-ecp/kustomization.yaml

@@ -4,4 +4,6 @@ kind: Kustomization
 namespace: django
 resources:
   - frontend.yaml
+  - s3-proxy.yaml
+  - s3-proxy-bim.yaml
 #  - namespace.yaml

apps/django/yc-ecp/s3-proxy-bim.yaml

@@ -0,0 +1,104 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: s3-proxy-bim
+  namespace: django
+spec:
+  interval: 5m
+  timeout: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      s3-proxy-bim:
+        enabled: true
+
+        # образ публичный, из Docker Hub — pull-секрет не нужен
+        image:
+          name:
+            _default: pottava/s3-proxy
+          pullPolicy:
+            _default: Always
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: s3-proxy-bim
+
+          replicaCount:
+            _default: 2
+
+          port:
+            _default: 80
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: s3-bim-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: false
+
+        envs:
+          - name: AWS_API_ENDPOINT
+            value:
+              _default: "https://storage.yandexcloud.net"
+
+        # ключи S3 лежат в Secret/s3-proxy-bim-secret, созданном вне этого релиза
+        secretEnvs:
+          - name: AWS_ACCESS_KEY_ID
+            secretName:
+              _default: "s3-proxy-bim-secret"
+            secretKey: "login"
+
+          - name: AWS_SECRET_ACCESS_KEY
+            secretName:
+              _default: "s3-proxy-bim-secret"
+            secretKey: "password"
+
+          - name: AWS_S3_BUCKET
+            secretName:
+              _default: "s3-proxy-bim-secret"
+            secretKey: "bucket"

apps/django/yc-ecp/s3-proxy.yaml

@@ -0,0 +1,105 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: s3-proxy
+  namespace: django
+spec:
+  interval: 5m
+  timeout: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.9"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      s3-proxy:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/s3-proxy:stable
+          pullPolicy:
+            _default: Always
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: s3-proxy
+
+          replicaCount:
+            _default: 2
+
+          port:
+            _default: 80
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: s3-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        envs:
+          - name: AWS_API_ENDPOINT
+            value:
+              _default: "https://storage.yandexcloud.net"
+
+        # ключи S3 лежат в Secret/s3-proxy-secret, созданном вне этого релиза
+        secretEnvs:
+          - name: AWS_ACCESS_KEY_ID
+            secretName:
+              _default: "s3-proxy-secret"
+            secretKey: "login"
+
+          - name: AWS_SECRET_ACCESS_KEY
+            secretName:
+              _default: "s3-proxy-secret"
+            secretKey: "password"
+
+          - name: AWS_S3_BUCKET
+            secretName:
+              _default: "s3-proxy-secret"
+            secretKey: "bucket"

infrastructure/istio-config/yc-ecp/istio-config.yaml

@@ -225,135 +225,135 @@ spec:
                 # он должен оставаться последним по порядку сопоставления
                 - service: frontend-service.django.svc.cluster.local
                   port: 80
-#
-#            bim-api-gazpromcps-api-virt-service:
-#              namespace: gateway
-#              hosts:
-#                - aero.invest.sarex.io
-#              gateways:
-#                - gateway/main-gateway
-#              cors:
-#                allowHeaders:
-#                  - Authorization
-#                  - Content-Type
-#                allowMethods:
-#                  - GET
-#                  - POST
-#                  - PUT
-#                  - PATCH
-#                  - HEAD
-#                  - DELETE
-#              routes:
-#                - path:
-#                    prefix: /bim-gazpromcps/api/
-#                  rewrite: /api/
-#                  service: bim-api-gazpromcps-service.bim.svc.cluster.local
-#                  port: 80
-#                - path:
-#                    prefix: /bim-gazpromcps/files/
-#                  rewrite: /files/
-#                  service: bim-api-gazpromcps-service.bim.svc.cluster.local
-#                  port: 80
-#
-#            bim-backend-v2-api-virt-service:
-#              namespace: gateway
-#              hosts:
-#                - aero.invest.sarex.io
-#              gateways:
-#                - gateway/main-gateway
-#              cors:
-#                allowHeaders:
-#                  - Authorization
-#                  - Content-Type
-#                allowMethods:
-#                  - GET
-#                  - POST
-#                  - PUT
-#                  - PATCH
-#                  - HEAD
-#                  - DELETE
-#              routes:
-#                - path:
-#                    prefix: /bim2-gazpromcps/api/
-#                  rewrite: /api/
-#                  service: bim-backend-v2-service.bim.svc.cluster.local
-#                  port: 80
-#
-#            eav-virt-service:
-#              namespace: gateway
-#              hosts:
-#                - aero.invest.sarex.io
-#              gateways:
-#                - gateway/main-gateway
-#              cors:
-#                allowHeaders:
-#                  - Authorization
-#                  - Content-Type
-#                allowMethods:
-#                  - POST
-#                  - GET
-#                  - PATCH
-#                  - DELETE
-#                  - HEAD
-#                  - PUT
-#                  - OPTIONS
-#              routes:
-#                - path:
-#                    prefix: /eav/api/
-#                  rewrite: /api/
-#                  service: eav-service.eav.svc.cluster.local
-#                  port: 8000
-#                  noCors: true
-#                - path:
-#                    prefix: /eav/admin/
-#                  rewrite: /eav/admin/
-#                  service: eav-service.eav.svc.cluster.local
-#                  port: 8000
-#
-#            api-virt-service:
-#              namespace: gateway
-#              hosts:
-#                - aero.invest.sarex.io
-#              gateways:
-#                - gateway/main-gateway
-#              cors:
-#                allowHeaders:
-#                  - Authorization
-#                  - Content-Type
-#                allowMethods:
-#                  - GET
-#                  - POST
-#                  - PUT
-#                  - PATCH
-#                  - HEAD
-#                  - DELETE
-#              routes:
-#                - path:
-#                    prefix: /workflows/api/
-#                  rewrite: /api/
-#                  service: workflows-backend-service.processing.svc.cluster.local
-#                  port: 80
-#
-#            projects-frontend-static-virt-service:
-#              namespace: gateway
-#              hosts:
-#                - aero.invest.sarex.io
-#              gateways:
-#                - gateway/main-gateway
-#              cors:
-#                allowHeaders:
-#                  - Authorization
-#                  - Content-Type
-#                allowMethods:
-#                  - GET
-#                  - POST
-#                  - PUT
-#                  - PATCH
-#                  - HEAD
-#                  - DELETE
-#              routes:
-#                - path:
-#                    prefix: /projects/static/
-#                  rewrite: /
-#                  service: projects-frontend-static-service.projects.svc.cluster.local
-#                  port: 80
+
+            bim-api-gazpromcps-api-virt-service:
+              namespace: gateway
+              hosts:
+                - aero.invest.sarex.io
+              gateways:
+                - gateway/main-gateway
+              cors:
+                allowHeaders:
+                  - Authorization
+                  - Content-Type
+                allowMethods:
+                  - GET
+                  - POST
+                  - PUT
+                  - PATCH
+                  - HEAD
+                  - DELETE
+              routes:
+                - path:
+                    prefix: /bim-gazpromcps/api/
+                  rewrite: /api/
+                  service: bim-api-gazpromcps-service.bim.svc.cluster.local
+                  port: 80
+                - path:
+                    prefix: /bim-gazpromcps/files/
+                  rewrite: /files/
+                  service: bim-api-gazpromcps-service.bim.svc.cluster.local
+                  port: 80
+
+            bim-backend-v2-api-virt-service:
+              namespace: gateway
+              hosts:
+                - aero.invest.sarex.io
+              gateways:
+                - gateway/main-gateway
+              cors:
+                allowHeaders:
+                  - Authorization
+                  - Content-Type
+                allowMethods:
+                  - GET
+                  - POST
+                  - PUT
+                  - PATCH
+                  - HEAD
+                  - DELETE
+              routes:
+                - path:
+                    prefix: /bim2-gazpromcps/api/
+                  rewrite: /api/
+                  service: bim-backend-v2-service.bim.svc.cluster.local
+                  port: 80
+
+            eav-virt-service:
+              namespace: gateway
+              hosts:
+                - aero.invest.sarex.io
+              gateways:
+                - gateway/main-gateway
+              cors:
+                allowHeaders:
+                  - Authorization
+                  - Content-Type
+                allowMethods:
+                  - POST
+                  - GET
+                  - PATCH
+                  - DELETE
+                  - HEAD
+                  - PUT
+                  - OPTIONS
+              routes:
+                - path:
+                    prefix: /eav/api/
+                  rewrite: /api/
+                  service: eav-service.eav.svc.cluster.local
+                  port: 8000
+                  noCors: true
+                - path:
+                    prefix: /eav/admin/
+                  rewrite: /eav/admin/
+                  service: eav-service.eav.svc.cluster.local
+                  port: 8000
+
+            api-virt-service:
+              namespace: gateway
+              hosts:
+                - aero.invest.sarex.io
+              gateways:
+                - gateway/main-gateway
+              cors:
+                allowHeaders:
+                  - Authorization
+                  - Content-Type
+                allowMethods:
+                  - GET
+                  - POST
+                  - PUT
+                  - PATCH
+                  - HEAD
+                  - DELETE
+              routes:
+                - path:
+                    prefix: /workflows/api/
+                  rewrite: /api/
+                  service: workflows-backend-service.processing.svc.cluster.local
+                  port: 80
+
+            projects-frontend-static-virt-service:
+              namespace: gateway
+              hosts:
+                - aero.invest.sarex.io
+              gateways:
+                - gateway/main-gateway
+              cors:
+                allowHeaders:
+                  - Authorization
+                  - Content-Type
+                allowMethods:
+                  - GET
+                  - POST
+                  - PUT
+                  - PATCH
+                  - HEAD
+                  - DELETE
+              routes:
+                - path:
+                    prefix: /projects/static/
+                  rewrite: /
+                  service: projects-frontend-static-service.projects.svc.cluster.local
+                  port: 80