++ schedule wb trino coordinator on processing

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.gitignore

@@ -6,3 +6,5 @@ CLAUDE.md
 tmp
 .tmp/
 snapshots/*
+scripts/.venv
+scripts

apps/ams-sync/wb/kustomization.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: ams-sync
+resources:
+  - ../base
+patches:
+  - path: patch.yaml
+    target:
+      kind: HelmRelease
+      name: ams-sync

apps/ams-sync/wb/patch.yaml

@@ -0,0 +1,55 @@
+---
+# Патч для контура wb.
+#
+# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
+# поэтому здесь продублирован весь набор из apps/ams-sync/base/helmrelease.yaml.
+#
+# В base image-тег и USER_SERVER_HOST/AUTH_HOST зашиты под другого клиента
+# (sarex.ugok.lan, образ ams-sync:ugok) — для wb это srx.wb.ru.
+# secretEnvs (telegram/zitadel/kafka/db) не трогаем — они читаются из обычных
+# k8s Secret'ов (не vault-agent), которые в wb уже должны быть заведены отдельно.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: ams-sync
+  namespace: ams-sync
+spec:
+  values:
+    services:
+      backend:
+        envs:
+          - name: AMS_SYNC_TOPIC
+            value:
+              _default: "ams-sync"
+
+          - name: ENVIRONMENT
+            value:
+              _default: "PRODUCTION"
+
+          - name: HOST_ORGANIZATION_ID
+            value:
+              _default: "368536846176636704"
+
+          - name: ALERT_ENABLED
+            value:
+              _default: "False"
+
+          - name: USER_SERVER_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: AUTH_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: VERIFY_USERS
+            value:
+              _default: "True"
+
+          - name: KAFKA_SECURITY_PROTOCOL
+            value:
+              _default: "SSL"
+
+          - name: KAFKA_SASL_MECHANISM
+            value:
+              _default: "SCRAM-SHA-512"

apps/attachments/wb/backend.yaml

@@ -0,0 +1,154 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: attachments
+  namespace: attachments
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      attachments:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/att9:dev
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: attachments
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: attachments-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: yc-s3
+              mountPath:
+                _default: /etc/sarex/yc-s3-storage
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: yc-s3
+
+        envs:
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "10"
+
+          - name: API_ADDRESS
+            value:
+              _default: "0.0.0.0:8000"
+
+          - name: YANDEX_S3_ACCOUNT_PATH
+            value:
+              _default: "/etc/sarex/yc-s3-storage/yc-s3-service-account.json"
+
+          - name: BUCKET_NAME
+            value:
+              _default: "attachments-storage"
+
+          - name: DATABASE_SSL_MODE
+            value:
+              _default: "disable"
+
+          - name: YANDEX_S3_VERIFY
+            value:
+              _default: "false"
+
+          - name: YANDEX_S3_USE_SSL
+            value:
+              _default: "false"
+
+        secretEnvs:
+          - name: DATABASE_HOST
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "host"
+
+          - name: DATABASE_PORT
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "port"
+
+          - name: DATABASE_NAME
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "database"
+
+          - name: DATABASE_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: DATABASE_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/attachments/wb/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: attachments
+resources:
+  - backend.yaml

apps/bim/wb/backend.yaml

@@ -0,0 +1,222 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: bim
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      backend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/bim-backend-v2:donstroi1
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: backend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: backend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        envs:
+          - name: LAST_MASTER_BIM
+            value:
+              _default: "100000"
+
+          - name: LAST_MASTER_BIM_V3
+            value:
+              _default: "100000"
+
+          - name: LAST_SLAVE_1_BIM
+            value:
+              _default: "1000000"
+
+          - name: POSTGRES_ADDRESS
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: POSTGRES_PORT
+            value:
+              _default: "6432"
+
+          - name: POSTGRES_DB
+            value:
+              _default: "bim_db"
+
+          - name: DB_CERT_PATH_2
+            value:
+              _default: "/root/yandex_pg.pem"
+
+          - name: POSTGRES_ADDRESS_2
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: POSTGRES_PORT_2
+            value:
+              _default: "6432"
+
+          - name: POSTGRES_DB_2
+            value:
+              _default: "bim_db"
+
+          - name: DB_CERT_PATH_3
+            value:
+              _default: "/root/yandex_pg.pem"
+
+          - name: POSTGRES_ADDRESS_3
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: POSTGRES_PORT_3
+            value:
+              _default: "6432"
+
+          - name: POSTGRES_DB_3
+            value:
+              _default: "bim_db"
+
+          - name: DB_CERT_PATH_4
+            value:
+              _default: "/root/yandex_pg.pem"
+
+          - name: POSTGRES_ADDRESS_4
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: POSTGRES_PORT_4
+            value:
+              _default: "6432"
+
+          - name: POSTGRES_DB_4
+            value:
+              _default: "bim_db"
+
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "30"
+
+          - name: API_ADDRESS
+            value:
+              _default: "0.0.0.0:8000"
+
+          - name: DJANGO_HOST
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+          - name: ENABLE_SQL_QUERY
+            value:
+              _default: "0"
+
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+
+        secretEnvs:
+          - name: POSTGRES_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: POSTGRES_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: POSTGRES_USER_2
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: POSTGRES_PASSWORD_2
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: POSTGRES_USER_3
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: POSTGRES_PASSWORD_3
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: POSTGRES_USER_4
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: POSTGRES_PASSWORD_4
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/bim/wb/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: bim
+resources:
+  - backend.yaml

apps/checklists/wb/backend.yaml

@@ -0,0 +1,145 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: checklists-backend
+  namespace: checklists
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      checklists-backend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/checklists-backend:production_68f242cd
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: checklists-backend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: checklists-backend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        envs:
+          - name: HTTP_APP_HOST
+            value:
+              _default: "0.0.0.0"
+
+          - name: HTTP_APP_PORT
+            value:
+              _default: "8000"
+
+          - name: HTTP_APP_ROOT_PATH
+            value:
+              _default: "/checklists"
+
+          - name: HTTP_APP_WORKERS
+            value:
+              _default: "8"
+
+          - name: HTTP_APP_ADMIN_ENABLE
+            value:
+              _default: "true"
+
+          - name: DATABASE_HOST
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: DATABASE_PORT
+            value:
+              _default: "5432"
+
+          - name: DATABASE_NAME
+            value:
+              _default: "checklists_db"
+
+          - name: JWT_AUTH_ENABLE
+            value:
+              _default: "true"
+
+          - name: DEBUG
+            value:
+              _default: "false"
+
+        secretEnvs:
+          - name: DATABASE_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "user"
+
+          - name: DATABASE_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: JWT_AUTH_PUBLIC_KEY
+            secretName:
+              _default: "jwt-secret"
+            secretKey: "public-key"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/checklists/wb/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: checklists
+resources:
+  - backend.yaml

apps/comparisons/wb/backend.yaml

@@ -0,0 +1,94 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: comparisons
+spec:
+  values:
+    services:
+      backend:
+        envs:
+          - name: APP_NAME
+            value:
+              _default: "comparisons"
+
+          - name: APP_VERSION
+            value:
+              _default: "0.0.1"
+
+          - name: LOGGER_LOG_LEVEL
+            value:
+              _default: "info"
+
+          - name: DATABASE_NAME
+            value:
+              _default: "postgres"
+
+          - name: ENABLE_SSL
+            value:
+              _default: "false"
+
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "10"
+
+          - name: HTTP_PORT
+            value:
+              _default: "8000"
+
+          - name: DOCUMENTATIONS_INTERNAL_HOST
+            value:
+              _default: "http://documentations-service.documentations"
+
+          - name: DOCUMENTATIONS_EXTERNAL_HOST
+            value:
+              _default: "https://lk.srx.wb.ru:30443/documentations"
+
+          - name: DOCUMENTATION_FILESTREAM_URL
+            value:
+              _default: "http://backend-filestream-svc.documentations.svc.cluster.local/"
+
+          - name: WORKFLOWS_HOST
+            value:
+              _default: "http://workflows-service.workflow"
+
+          - name: WORKFLOWS_IMAGE_VERSION
+            value:
+              _default: "master"
+
+          - name: WORKFLOWS_DJANGO_HOST
+            value:
+              _default: "https://lk.srx.wb.ru:30443"
+
+          - name: WORKFLOWS_BIMV2_INTERNAL_HOST
+            value:
+              _default: "http://bim-backend-v2-service.bim-api"
+
+          - name: WORKSPACES_HOST
+            value:
+              _default: "http://workspaces-service.workspaces"
+
+          - name: EAV_HOST
+            value:
+              _default: "https://lk.srx.wb.ru:30443/eav"
+
+          - name: LAST_MASTER_BIM
+            value:
+              _default: "36311"
+
+          - name: LAST_SLAVE_1_BIM
+            value:
+              _default: "94015"
+
+          - name: LAST_SLAVE_2_BIM
+            value:
+              _default: "135771"
+
+          - name: ABAP_FIXED_CONC
+            value:
+              _default: "0"
+
+          - name: WORKFLOWS_CONFIG_FILEPATH
+            value:
+              _default: "/etc/app/tasks-execution-config.json"

apps/comparisons/wb/kustomization.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: comparisons
+resources:
+  - ../base
+patches:
+  - path: backend.yaml
+    target:
+      kind: HelmRelease
+      name: backend

apps/contracts/wb/backend.yaml

@@ -0,0 +1,99 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: contracts
+  namespace: contracts
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      contracts:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/contracts:prod_d3bbd9fc
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: contracts
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8080
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: contracts-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8080
+
+          targetPort:
+            _default: 8080
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        secretEnvs:
+          - name: DB_URL
+            secretName:
+              _default: "ya-pg-secret"
+            secretKey: "db_url"
+
+          - name: PUBLIC_KEY
+            secretName:
+              _default: "public-key"
+            secretKey: "key"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/contracts/wb/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: contracts
+resources:
+  - backend.yaml

apps/django/wb/auth-flow-frontend.yaml

@@ -0,0 +1,97 @@
+---
+# auth-flow-frontend — компонент приложения auth-flow (apps/auth-flow),
+# в wb развёрнут в ns django, а не в своём собственном неймспейсе.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: auth-flow-frontend
+  namespace: django
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      auth-flow-frontend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/auth-flow-frontend:contour_fe9ea2a3
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: auth-flow-frontend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          resources:
+            requests:
+              cpu:
+                _default: 100m
+              memory:
+                _default: 128Mi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: auth-flow-frontend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/django/wb/backend.yaml

@@ -0,0 +1,444 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: django
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      backend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/backend:production_7d0ec48b
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: backend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: backend-svc
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: tmp-volume
+              mountPath:
+                _default: /tmp
+              emptyDir: {}
+
+            - name: uwsgi-configmap
+              mountPath:
+                _default: /opt/sarex/uwsgi.ini
+              subPath:
+                _default: uwsgi.ini
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: uwsgi-configmap
+                items:
+                  - key: uwsgi.ini
+                    path:
+                      _default: uwsgi.ini
+
+            - name: django-configmap
+              mountPath:
+                _default: /opt/sarex/config/settings/production.py
+              subPath:
+                _default: production.py
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: django-configmap
+                items:
+                  - key: production.py
+                    path:
+                      _default: production.py
+
+            - name: kafka-cert-volume
+              mountPath:
+                _default: /usr/local/share/ca-certificates
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: kafka-cert
+
+        envs:
+          - name: GK_ENCRYPTION_KEY
+            value:
+              _default: "zfDjuszywHSbAhY8KJQbESbpUYN74XTs"
+
+          - name: ALLOWED_HOSTS
+            value:
+              _default: "*"
+
+          - name: SERVER_USE_CHANGELOG
+            value:
+              _default: "0"
+
+          - name: SERVER_ZITADEL_ENABLED
+            value:
+              _default: "True"
+
+          - name: DJANGO_SETTINGS_MODULE
+            value:
+              _default: "config.settings.production"
+
+          - name: CELERY_REDIS_HOST
+            value:
+              _default: "redis-service"
+
+          - name: CELERY_REDIS_PORT
+            value:
+              _default: "6379"
+
+          - name: DJANGO_REDIS_HOST
+            value:
+              _default: "redis-service"
+
+          - name: DJANGO_REDIS_PORT
+            value:
+              _default: "6379"
+
+          - name: BIMV2_INTERNAL_HOST
+            value:
+              _default: "http://bim-backend-v2-service.bim-api"
+
+          - name: BIMV2_TIMEOUT
+            value:
+              _default: "60"
+
+          - name: JWT_KID
+            value:
+              _default: "1"
+
+          - name: PDM_SYNC
+            value:
+              _default: "1"
+
+          - name: KC_SYNC_ENABLE
+            value:
+              _default: "0"
+
+          - name: MEASUREMENTS_HOST
+            value:
+              _default: "http://measurements-service.measurements.svc.cluster.local:8000/api"
+
+          - name: MEASUREMENTS_USE_MEASUREMENTS
+            value:
+              _default: "1"
+
+          - name: SERVER_EXTERNAL_FIND_BY_USERNAME_ENABLED
+            value:
+              _default: "True"
+
+          - name: SERVER_EXTERNAL_FIND_BY_EMAIL_ENABLED
+            value:
+              _default: "True"
+
+          - name: SERVER_API_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: SERVER_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: WORKFLOWS_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: WORKFLOWS_BASE_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: WORKFLOWS_USE
+            value:
+              _default: "1"
+
+          - name: SERVER_S3_STREAM_IMPORT
+            value:
+              _default: "1"
+
+          - name: SERVER_SAVE_DIFF_DEM
+            value:
+              _default: "1"
+
+          - name: SERVER_USE_CLICKHOUSE
+            value:
+              _default: "0"
+
+          - name: SERVER_USE_CREATE_COMPARED_GEOTIFF_TASK
+            value:
+              _default: "0"
+
+          - name: SERVER_USE_DJANGO_STORAGE
+            value:
+              _default: "1"
+
+          - name: SERVER_USE_METASHAPE
+            value:
+              _default: "0"
+
+          - name: SERVER_CHANGELOG_MODE_SYSTEM_LOG
+            value:
+              _default: "1"
+
+          - name: SERVER_CHANGELOG_MODE
+            value:
+              _default: "0"
+
+          - name: SERVER_DJANGO_URLS
+            value:
+              _default: "1"
+
+          - name: CHECK_IMPORT_HASH
+            value:
+              _default: "1"
+
+          - name: EAV_ENABLE
+            value:
+              _default: "1"
+
+          - name: SERVER_CHECK_IMPORT_HASH
+            value:
+              _default: "1"
+
+          - name: SERVER_CHUNKED_PATH
+            value:
+              _default: "/tmp/chunked_uploads/%Y/%m/%d"
+
+          - name: SERVER_HIDE_USER_SCROLL_PERMISSIONS
+            value:
+              _default: "0"
+
+          - name: SERVER_USE_WRORKFLOW_STATUS
+            value:
+              _default: "1"
+
+          - name: ZITADEL_HOST
+            value:
+              _default: "https://zitadel-srx.wb.ru"
+
+          - name: SERVER_KAFKA_ENABLED
+            value:
+              _default: "True"
+
+          - name: KAFKA_TOPICS
+            value:
+              _default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}'
+
+          - name: KAFKA_BOOTSTRAP_SERVERS
+            value:
+              _default: '["wb-prod-kafka-bootstrap.kafka.svc.cluster.local:9093"]'
+
+          - name: KAFKA_SECURITY_PROTOCOL
+            value:
+              _default: "SSL"
+
+          - name: KAFKA_SASL_MECHANISM
+            value:
+              _default: "SCRAM-SHA-512"
+
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: "/usr/local/share/ca-certificates/kafka.crt"
+
+          - name: S3_HOST
+            value:
+              _default: "http://10.49.10.90:9000"
+
+          - name: KC_USE_REDIRECT_LOGOUT
+            value:
+              _default: "False"
+
+        secretEnvs:
+          - name: ZITADEL_ACCESS_TOKEN
+            secretName:
+              _default: "zitadel-secret"
+            secretKey: "access_token"
+
+          - name: KAFKA_SASL_PLAIN_USERNAME
+            secretName:
+              _default: "kafka-secret"
+            secretKey: "username"
+
+          - name: KAFKA_SASL_PLAIN_PASSWORD
+            secretName:
+              _default: "kafka-secret"
+            secretKey: "password"
+
+          - name: KC_CLIENT_ID
+            secretName:
+              _default: "gatekeeper-secret"
+            secretKey: "client_id"
+
+          - name: KC_CLIENT_SECRET
+            secretName:
+              _default: "gatekeeper-secret"
+            secretKey: "client_secret"
+
+          - name: AWS_S3_ENDPOINT_URL
+            secretName:
+              _default: "s3-secret"
+            secretKey: "endpoint"
+
+          - name: CELERY_RABBITMQ_HOST
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "host"
+
+          - name: CELERY_RABBITMQ_USER
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "username"
+
+          - name: CELERY_RABBITMQ_PASSWORD
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "password"
+
+          - name: CELERY_RABBITMQ_VHOST
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "vhost"
+
+          - name: DJANGO_POSTGRES_HOST
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "host"
+
+          - name: DJANGO_POSTGRES_PORTS
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "port"
+
+          - name: DJANGO_POSTGRES_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: DJANGO_POSTGRES_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: DJANGO_POSTGRES_DATABASE
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "database"
+
+          - name: DJANGO_RABBIT_HOSTNAME
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "host"
+
+          - name: DJANGO_RABBIT_USER
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "username"
+
+          - name: DJANGO_RABBIT_PASS
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "password"
+
+          - name: DJANGO_RABBIT_VHOST
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "vhost"
+
+          - name: JWT_PRIVATE_KEY
+            secretName:
+              _default: "backend-secret"
+            secretKey: "ssh_private.key"
+
+          - name: JWT_PUBLIC_KEY
+            secretName:
+              _default: "backend-secret"
+            secretKey: "ssh_public.key"
+
+          - name: S3_BUCKET
+            secretName:
+              _default: "sarex-media-storage-secret"
+            secretKey: "bucket"
+
+          - name: S3_LOGIN
+            secretName:
+              _default: "sarex-media-storage-secret"
+            secretKey: "login"
+
+          - name: S3_PASSWORD
+            secretName:
+              _default: "sarex-media-storage-secret"
+            secretKey: "password"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/django/wb/celery.yaml

@@ -0,0 +1,428 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: celery
+  namespace: django
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      celery:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/backend:production_7d0ec48b
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: celery
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          command:
+            _default: ["celery", "-A", "config", "worker", "-B", "-l", "info", "-E", "-Q", "default", "-n", "default_worker.%h", "--concurrency=2"]
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: false
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: tmp-volume
+              mountPath:
+                _default: /tmp
+              emptyDir: {}
+
+            - name: uwsgi-configmap
+              mountPath:
+                _default: /opt/sarex/uwsgi.ini
+              subPath:
+                _default: uwsgi.ini
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: uwsgi-configmap
+                items:
+                  - key: uwsgi.ini
+                    path:
+                      _default: uwsgi.ini
+
+            - name: django-configmap
+              mountPath:
+                _default: /opt/sarex/config/settings/production.py
+              subPath:
+                _default: production.py
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: django-configmap
+                items:
+                  - key: production.py
+                    path:
+                      _default: production.py
+
+            - name: kafka-cert-volume
+              mountPath:
+                _default: /usr/local/share/ca-certificates
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: kafka-cert
+
+        envs:
+          - name: GK_ENCRYPTION_KEY
+            value:
+              _default: "zfDjuszywHSbAhY8KJQbESbpUYN74XTs"
+
+          - name: ALLOWED_HOSTS
+            value:
+              _default: "*"
+
+          - name: SERVER_USE_CHANGELOG
+            value:
+              _default: "0"
+
+          - name: SERVER_ZITADEL_ENABLED
+            value:
+              _default: "False"
+
+          - name: DJANGO_SETTINGS_MODULE
+            value:
+              _default: "config.settings.production"
+
+          - name: CELERY_REDIS_HOST
+            value:
+              _default: "redis-service"
+
+          - name: CELERY_REDIS_PORT
+            value:
+              _default: "6379"
+
+          - name: DJANGO_REDIS_HOST
+            value:
+              _default: "redis-service"
+
+          - name: CACHE_HOST
+            value:
+              _default: "redis.pm.svc.cluster.local"
+
+          - name: DJANGO_REDIS_PORT
+            value:
+              _default: "6379"
+
+          - name: BIMV2_INTERNAL_HOST
+            value:
+              _default: "http://bim-backend-v2-service.bim-api"
+
+          - name: BIMV2_TIMEOUT
+            value:
+              _default: "60"
+
+          - name: JWT_KID
+            value:
+              _default: "1"
+
+          - name: PDM_SYNC
+            value:
+              _default: "1"
+
+          - name: KC_SYNC_ENABLE
+            value:
+              _default: "0"
+
+          - name: MEASUREMENTS_HOST
+            value:
+              _default: "http://measurements-service.measurements.svc.cluster.local:8000/api"
+
+          - name: MEASUREMENTS_USE_MEASUREMENTS
+            value:
+              _default: "1"
+
+          - name: SERVER_API_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: SERVER_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: WORKFLOWS_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: WORKFLOWS_BASE_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: WORKFLOWS_USE
+            value:
+              _default: "1"
+
+          - name: SERVER_S3_STREAM_IMPORT
+            value:
+              _default: "1"
+
+          - name: SERVER_SAVE_DIFF_DEM
+            value:
+              _default: "1"
+
+          - name: SERVER_USE_CLICKHOUSE
+            value:
+              _default: "0"
+
+          - name: SERVER_USE_CREATE_COMPARED_GEOTIFF_TASK
+            value:
+              _default: "0"
+
+          - name: SERVER_USE_DJANGO_STORAGE
+            value:
+              _default: "1"
+
+          - name: SERVER_USE_METASHAPE
+            value:
+              _default: "0"
+
+          - name: SERVER_CHANGELOG_MODE_SYSTEM_LOG
+            value:
+              _default: "1"
+
+          - name: ZITADEL_HOST
+            value:
+              _default: "https://zitadel-srx.wb.ru"
+
+          - name: SERVER_KAFKA_ENABLED
+            value:
+              _default: "True"
+
+          - name: KAFKA_TOPICS
+            value:
+              _default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}'
+
+          - name: KAFKA_BOOTSTRAP_SERVERS
+            value:
+              _default: '["wb-prod-kafka-bootstrap.kafka.svc.cluster.local:9093"]'
+
+          - name: KAFKA_SECURITY_PROTOCOL
+            value:
+              _default: "SSL"
+
+          - name: KAFKA_SASL_MECHANISM
+            value:
+              _default: "SCRAM-SHA-512"
+
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: "/usr/local/share/ca-certificates/kafka.crt"
+
+          - name: SERVER_CHANGELOG_MODE
+            value:
+              _default: "0"
+
+          - name: SERVER_DJANGO_URLS
+            value:
+              _default: "1"
+
+          - name: CHECK_IMPORT_HASH
+            value:
+              _default: "1"
+
+          - name: EAV_ENABLE
+            value:
+              _default: "1"
+
+          - name: SERVER_CHECK_IMPORT_HASH
+            value:
+              _default: "1"
+
+          - name: SERVER_CHUNKED_PATH
+            value:
+              _default: "/tmp/chunked_uploads/%Y/%m/%d"
+
+          - name: SERVER_HIDE_USER_SCROLL_PERMISSIONS
+            value:
+              _default: "0"
+
+          - name: SERVER_USE_WRORKFLOW_STATUS
+            value:
+              _default: "1"
+
+          - name: S3_HOST
+            value:
+              _default: "http://10.49.10.90:9000"
+
+          - name: KC_USE_REDIRECT_LOGOUT
+            value:
+              _default: "False"
+
+        secretEnvs:
+          - name: ZITADEL_ACCESS_TOKEN
+            secretName:
+              _default: "zitadel-secret"
+            secretKey: "access_token"
+
+          - name: KAFKA_SASL_PLAIN_USERNAME
+            secretName:
+              _default: "kafka-secret"
+            secretKey: "username"
+
+          - name: KAFKA_SASL_PLAIN_PASSWORD
+            secretName:
+              _default: "kafka-secret"
+            secretKey: "password"
+
+          - name: KC_CLIENT_ID
+            secretName:
+              _default: "gatekeeper-secret"
+            secretKey: "client_id"
+
+          - name: KC_CLIENT_SECRET
+            secretName:
+              _default: "gatekeeper-secret"
+            secretKey: "client_secret"
+
+          - name: AWS_S3_ENDPOINT_URL
+            secretName:
+              _default: "s3-secret"
+            secretKey: "endpoint"
+
+          - name: CELERY_RABBITMQ_HOST
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "host"
+
+          - name: CELERY_RABBITMQ_USER
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "username"
+
+          - name: CELERY_RABBITMQ_PASSWORD
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "password"
+
+          - name: CELERY_RABBITMQ_VHOST
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "vhost"
+
+          - name: DJANGO_POSTGRES_HOST
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "host"
+
+          - name: DJANGO_POSTGRES_PORTS
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "port"
+
+          - name: DJANGO_POSTGRES_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: DJANGO_POSTGRES_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: DJANGO_POSTGRES_DATABASE
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "database"
+
+          - name: DJANGO_RABBIT_HOSTNAME
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "host"
+
+          - name: DJANGO_RABBIT_USER
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "username"
+
+          - name: DJANGO_RABBIT_PASS
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "password"
+
+          - name: DJANGO_RABBIT_VHOST
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "vhost"
+
+          - name: JWT_PRIVATE_KEY
+            secretName:
+              _default: "backend-secret"
+            secretKey: "ssh_private.key"
+
+          - name: JWT_PUBLIC_KEY
+            secretName:
+              _default: "backend-secret"
+            secretKey: "ssh_public.key"
+
+          - name: S3_BUCKET
+            secretName:
+              _default: "sarex-media-storage-secret"
+            secretKey: "bucket"
+
+          - name: S3_LOGIN
+            secretName:
+              _default: "sarex-media-storage-secret"
+            secretKey: "login"
+
+          - name: S3_PASSWORD
+            secretName:
+              _default: "sarex-media-storage-secret"
+            secretKey: "password"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/django/wb/django-configmap.yaml

@@ -0,0 +1,287 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: django-configmap
+  namespace: django
+data:
+  production.py: |
+
+    import os
+    from .base import *
+    from logging.handlers import SysLogHandler
+    from datetime import timedelta
+
+    ALLOWED_HOSTS = ["*"]
+    FILE_UPLOAD_PERMISSIONS = 0o644
+    DEBUG = False
+    CSRF_COOKIE_SECURE = True
+    CSRF_TRUSTED_ORIGINS = ["https://lk.srx.wb.ru:30443", "https://lk.srx.wb.ru"]
+    SESSION_COOKIE_SECURE = True
+    SECURE_SSL_REDIRECT = False
+
+    SECRET_KEY = 't2=9+($2f%7ptsdy4!rby$)mcfl1l%o2e@vs^d(g&(wwi&%k1v'
+
+    CORS_ORIGIN_ALLOW_ALL = True
+    SERVERSETTINGS.cache_enabled = True
+    INSTALLED_APPS = list(INSTALLED_APPS) + ['corsheaders']
+
+    CORS_ALLOW_METHODS = (
+        'DELETE',
+        'GET',
+        'OPTIONS',
+        'PATCH',
+        'POST',
+        'PUT',
+    )
+    BASIC_USER_ID = 2
+
+    CORS_ALLOW_HEADERS = (
+        'accept',
+        'accept-encoding',
+        'authorization',
+        'content-type',
+        'user-agent',
+        'x-csrftoken',
+        'x-requested-with',
+        'x-token',
+        'Bearer',
+    )
+
+    HOST = "https://wb.sarex.io"
+
+    POSTGRES_DATABASE = os.environ.get('DJANGO_POSTGRES_DATABASE')
+    POSTGRES_USER = os.environ.get('DJANGO_POSTGRES_USER')
+    POSTGRES_PASSWORD = os.environ.get('DJANGO_POSTGRES_PASSWORD')
+    POSTGRES_HOST = os.environ.get('DJANGO_POSTGRES_HOST')
+    POSTGRES_PORTS = os.environ.get('DJANGO_POSTGRES_PORTS', "5432")
+
+    DATABASES = {
+        'default': {
+            'ENGINE': 'django_prometheus.db.backends.postgresql',
+            'NAME': POSTGRES_DATABASE,
+            'USER': POSTGRES_USER,
+            'PASSWORD': POSTGRES_PASSWORD,
+            'HOST': POSTGRES_HOST,
+            'PORT': POSTGRES_PORTS,
+        }
+    }
+
+    LOGGING = {
+        'version': 1,
+        'disable_existing_loggers': False,
+        'filters': {
+            'require_debug_false': {
+                '()': 'django.utils.log.RequireDebugFalse',
+            }
+        },
+        'formatters': {
+            'verbose': {
+                'format': '[contactor] %(levelname)s %(asctime)s %(message)s',
+            },
+        },
+        'handlers': {
+            'console': {
+                'level': 'DEBUG',
+                'class': 'logging.StreamHandler',
+            },
+            'sentry': {
+                'level': 'ERROR',
+                'filters': ['require_debug_false'],
+                'class': 'logging.StreamHandler',
+            },
+        },
+        'loggers': {
+            '': {
+                'handlers': ['console', 'sentry'],
+                'level': 'INFO',
+                'propagate': False,
+            },
+        }
+    }
+
+    COMPARATOR_JWT = os.environ.get("COMPARATOR_JWT", "default_jwt")
+    COMPARATOR_URL = os.environ.get("COMPARATOR_URL", "https://wb.sarex.io/comparator")
+    COMPARATOR_SECTION = os.environ.get("COMPARATOR_SECTION", "sarex-production-storage")
+
+    SIMPLE_JWT = {
+        'ACCESS_TOKEN_LIFETIME': timedelta(hours=1),
+        'REFRESH_TOKEN_LIFETIME': timedelta(days=1),
+        'ROTATE_REFRESH_TOKENS': False,
+        'BLACKLIST_AFTER_ROTATION': True,
+        'UPDATE_LAST_LOGIN': False,
+        'ALGORITHM': 'RS512',
+        'SIGNING_KEY': os.environ.get("JWT_PRIVATE_KEY").replace("\\n", "\n"),
+        'VERIFYING_KEY': os.environ.get("JWT_PUBLIC_KEY").replace("\\n", "\n"),
+        'AUDIENCE': None,
+        'ISSUER': os.environ.get('SIMPLE_JWT_ISSUER', 'default_issuer'),
+        'AUTH_HEADER_TYPES': ('Bearer',),
+        'AUTH_HEADER_NAME': 'HTTP_AUTHORIZATION',
+        'USER_ID_FIELD': 'id',
+        'USER_ID_CLAIM': 'user_id',
+        'AUTH_TOKEN_CLASSES': ('rest_framework_simplejwt.tokens.AccessToken',),
+        'TOKEN_TYPE_CLAIM': 'token_type',
+        'JTI_CLAIM': 'jti',
+        'SLIDING_TOKEN_REFRESH_EXP_CLAIM': 'refresh_exp',
+        'SLIDING_TOKEN_LIFETIME': timedelta(minutes=5),
+        'SLIDING_TOKEN_REFRESH_LIFETIME': timedelta(days=1),
+    }
+
+    os.environ["DJANGO_ALLOW_ASYNC_UNSAFE"] = "true"
+    DEFAULT_FILE_STORAGE = 'sarex.core.storages.CustomS3Boto3Storage'
+    DATA_UPLOAD_MAX_MEMORY_SIZE = 268435456
+
+    if not os.environ.get('ISOLATED', False):
+        import sentry_sdk
+        from sentry_sdk.integrations.django import DjangoIntegration
+
+        sentry_sdk.init(
+            dsn="https://3df2f4b8d3d14595a06c92e9d7c562cb@sentry.io/1501541",
+            integrations=[DjangoIntegration()],
+            environment=os.environ.get('SENTRY_ENVIRONMENT', 'production'),
+            send_default_pii=True,
+        )
+
+    COMPARISON_API_URL = f"{os.environ.get('WORKFLOWSSETTINGS_HOST')}/comparisons"
+    DOCUMENTATION_API_URL = f"{os.environ.get('WORKFLOWSSETTINGS_HOST')}/documentations"
+    PDM_FILES_API_URL = f"{os.environ.get('WORKFLOWSSETTINGS_HOST')}/files"
+
+    WORKFLOWS_TASKS = {
+        "update_orthomosaic_data": {
+            "image": f"{os.environ.get('WORKFLOWSSETTINGS_REGISTRY')}/update-orthomosaic-data:dev",
+            "service_requests": ["django-auth"],
+            "backoff_limit": 3,
+        },
+    }
+
+    REST_FRAMEWORK = {      'DEFAULT_PAGINATION_CLASS': (
+        'rest_framework.pagination.LimitOffsetPagination'      ),
+        'DEFAULT_SCHEMA_CLASS': 'rest_framework.schemas.coreapi.AutoSchema',
+        'PAGE_SIZE': 1000,      'DEFAULT_FILTER_BACKENDS': [
+        'django_filters.rest_framework.DjangoFilterBackend'      ],
+        'DEFAULT_AUTHENTICATION_CLASSES': [
+        'sarex.authentication.backends.ZitadelJWTAuthentication',
+        'rest_framework.authentication.RemoteUserAuthentication',
+        'rest_framework_simplejwt.authentication.JWTAuthentication',
+        'rest_framework.authentication.BasicAuthentication',
+        'rest_framework.authentication.SessionAuthentication',
+        'sarex.authentication.backends.JWTAuthentication'      ],
+        'DEFAULT_PERMISSION_CLASSES': [
+        'rest_framework.permissions.IsAuthenticated',      ]  }
+
+    AUTHENTICATION_BACKENDS = [
+        'sarex.authentication.backends.CustomRemoteUserBackend',
+        'django.contrib.auth.backends.ModelBackend',
+        'guardian.backends.ObjectPermissionBackend',
+    ]
+
+    MIDDLEWARE = [
+        'django_prometheus.middleware.PrometheusBeforeMiddleware',
+        'django.middleware.security.SecurityMiddleware',
+        'django.contrib.sessions.middleware.SessionMiddleware',
+        'django.middleware.common.CommonMiddleware',
+        'django.middleware.csrf.CsrfViewMiddleware',
+        #'django_keycloak.middlewares.AuthorizationHeaderMiddleware',
+        #'django_keycloak.middlewares.KeycloakSessionMiddleware',
+        'django.contrib.auth.middleware.AuthenticationMiddleware',
+        #'django.contrib.auth.middleware.RemoteUserMiddleware',
+        'django.contrib.messages.middleware.MessageMiddleware',
+        'django.middleware.clickjacking.XFrameOptionsMiddleware',
+        'django_user_agents.middleware.UserAgentMiddleware',
+        'simple_history.middleware.HistoryRequestMiddleware',
+        'django_prometheus.middleware.PrometheusAfterMiddleware',  ]
+
+
+    class KeyCloakSettings(BaseSettings):
+        client_id: str = "client_id"
+        client_secret: str = "client_secret"
+        discovery_url: str = "https://login.wb.sarex.io/realms/sarex/.well-known/openid-configuration"
+        staff: Optional[str] = "Sarex staff"
+        superuser: Optional[str] = "Sarex superusers"
+        sync_with_django: bool = True
+        sync_admin: bool = False
+        group_prefix: str = 'Sarex-Role'
+        company_prefix: str = 'Sarex-Company'
+        department_prefix: str = 'Sarex-Department'
+        position_prefix: str = 'Sarex-Position'
+        separator: str = '__'
+        sync_user_groups: bool = False
+        sync_user_positions: bool = False
+        sync_user_departments: bool = False
+        sync_user_companies: bool = False
+        use_redirect_logout: bool = False
+        logout_redirect_uri: str = "/"
+        default_group_name: Optional[str] = 'Тест'
+        default_company_name: Optional[str] = 'Брусника'
+        trusted_uri: List[str] = ['/api/core/orthophotos/', '/api/token', '/api/token/me']
+        trusted_uri: List[str] = []
+
+        class Config:
+            env_prefix = "KC_"
+
+
+    KEYCLOAKSETTINGS = KeyCloakSettings()
+
+    REMOTE_USER_DEFAULT_COMPANY_ID = 1
+    SAREX_MODULES = [
+        {
+            "name": "Замечания",
+            "uri": "/remarks"
+        },
+        {
+          "name": "Управление проектами",
+          "uri": "/management/projects",
+        },
+        {
+            "name": "Замечания V2",
+            "uri": "/issues"
+        },
+        {
+            "name": "Документация",
+            "uri": "/documentations"
+        },
+        {
+            "name": "Согласование документов",
+            "uri": "/reviews"
+        },
+        {
+            "name": "Рабочие процессы",
+            "uri": "/processes"
+        },
+         {
+            "name": "Запросы",
+            "uri": "/rfi"
+        },
+
+        {
+    		      "name": "Аналитика",
+    		      "uri": "/analytics"
+    		  },
+        #  {
+        #     "name": "Обзор",
+        #     "uri": "/projects"
+        # },
+        {
+          "name": "Передача документации",
+          "uri": "/transmittal"
+          },
+    ]
+    AUTH_SETTINGS = {
+      "refresh_token": False,
+      "refresh_token_uri": "/api/token/me",
+      "refresh_oauth_token": True,
+      "refresh_oauth_token_uri": "/oauth/token",
+      "refresh_time": 240,
+    }
+
+
+    DEBUG=False
+    #WEB_APP_AUTH_MODE='jwt-session-based'
+
+
+    SAREX_MODULES_SETTINGS = {
+        "aero": {
+            "enable_new_media": True
+        },
+        "sso_logout_redirect": True
+    }

apps/django/wb/export-project.yaml

@@ -0,0 +1,105 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: export-project
+  namespace: django
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      export-project:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/export-project:prod_ef8aa756
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: export-project
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          resources:
+            limits:
+              cpu:
+                _default: "2"
+              memory:
+                _default: 8Gi
+            requests:
+              cpu:
+                _default: "1"
+              memory:
+                _default: 512Mi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: export-project-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        envs:
+          - name: TIMEOUT
+            value:
+              _default: "180"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/django/wb/frontend.yaml

@@ -0,0 +1,118 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: django
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      frontend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-frontend-dev:contour_5.22.3
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: frontend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: frontend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: nginx-configmap
+              mountPath:
+                _default: /etc/nginx/nginx.conf
+              subPath:
+                _default: nginx.conf
+              configMap:
+                name:
+                  _default: nginx-configmap
+                items:
+                  - key: nginx.conf
+                    path:
+                      _default: nginx.conf
+
+            - name: zitadel-configmap
+              mountPath:
+                _default: /opt/react_client/static/config.json
+              subPath:
+                _default: config.json
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: zitadel-configmap
+                items:
+                  - key: config.json
+                    path:
+                      _default: config.json
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/django/wb/gatekeeper.yaml

@@ -0,0 +1,120 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: gatekeeper
+  namespace: django
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      gatekeeper:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/gatekeeper:2.12.1
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: gatekeeper
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8080
+
+          args:
+            _default:
+              - "--discovery-url=https://keycloak.wildberries.ru/realms/infrastructure/.well-known/openid-configuration"
+              - "--listen=0.0.0.0:8080"
+              - "--enable-logging=true"
+              - "--upstream-url=http://frontend-service.django.svc.cluster.local:80/"
+              - "--enable-refresh-tokens=true"
+              - "--enable-session-cookies=true"
+              - "--verbose"
+              - "--resources=uri=/*"
+              - "--encryption-key=zfDjuszywHSbAhY8KJQbESbpUYN74XTs"
+              - "--secure-cookie=false"
+              - "--cors-origins=*"
+              - "--skip-openid-provider-tls-verify=true"
+              - "--enable-default-deny=false"
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: gatekeeper-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 8080
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        envs:
+          - name: PROXY_REDIRECTION_URL
+            value:
+              _default: "https://lk.srx.wb.ru"
+
+        secretEnvs:
+          - name: PROXY_CLIENT_ID
+            secretName:
+              _default: "gatekeeper-secret"
+            secretKey: "client_id"
+
+          - name: PROXY_CLIENT_SECRET
+            secretName:
+              _default: "gatekeeper-secret"
+            secretKey: "client_secret"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/django/wb/kafka-cert-configmap.yaml

@@ -0,0 +1,38 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kafka-cert
+  namespace: django
+data:
+  kafka.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIIFLTCCAxWgAwIBAgIUYDZPxGRsr7IiqHEmfd07QTQlOKYwDQYJKoZIhvcNAQEN
+    BQAwLTETMBEGA1UECgwKaW8uc3RyaW16aTEWMBQGA1UEAwwNY2x1c3Rlci1jYSB2
+    MDAeFw0yNTEyMTYxNDM0NTVaFw0yNjEyMTYxNDM0NTVaMC0xEzARBgNVBAoMCmlv
+    LnN0cmltemkxFjAUBgNVBAMMDWNsdXN0ZXItY2EgdjAwggIiMA0GCSqGSIb3DQEB
+    AQUAA4ICDwAwggIKAoICAQCfzDZhEzw2pbU5Xpu8OzD+3iQG+DVjU8PQWWQEF27h
+    yjohDkUr3zCZtW7xMKWKUNxBgrKsfe4TDOQN8cij3cS9sy0So+UhMeF7Bq9PU1Yd
+    bmTRq8q1PiuNUkiCGJ5wrb3+NZvVxZLJUIFgiealsRw80MgMWWSzy0I35T2Edn/a
+    DU4jhlgQxyzQ621+oGP0n28gCjmm6pCq2tkj/Z8WTdu1gOWyRdK02a2uE2Ts2nLa
+    Di32GaZrIbIuD/WUd6Ek66uCeJvh2CT7s+SqgtMbtT7gibUuPQ3hk1VGQsjy22l3
+    hUNpLu86nrwbuf21mY55KnLOcaVq1ag1TpIIKfZAL/KWFCGZ6H6kwEIbCAL0Hei7
+    cJ2Wm2/qlzKUeU869M7YybZAfXl/t6XT4QgFgje+42N980vy5A4GhWi1Z7lPqqOe
+    jPGBstkRZybKz1sTk87+oJx82iQU/ozVmzjSEK1SoYRNbvug8PNpxmPoPnJ2flgG
+    t2q2+2ZQP3f1aAHVcZ3U5+hWlRmKPXzjrJv7gnhuvqJl7OwB50y+yWiVfZ9xrYl2
+    EpX+yHuFFK+9NnB5taUK8Fz+hQaLU8J4q7P0bRqkoI+LdcEErjuDT/eI2d5+Ql8K
+    /JkV823hX2WNB9bdaQ24BelVUbsxGpR7ms6KWrM11kHnbzUlEM+AxZES6F7Qbr55
+    TwIDAQABo0UwQzAdBgNVHQ4EFgQUM7hshx7e9TFEN82Pf446aBrJUA4wEgYDVR0T
+    AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQENBQADggIB
+    AFNHFGPDxY966fz0dxDFFSfeo47y7XQZMK9xAwH73cQoSeqx+IMxzgM8nfJQ9XMN
+    PeLwVRZ7pvRee2ZhUPglBSTHnW2rvfmLBOO9xyKZxRsCkoFxuHH9xfM7bFWb96R6
+    fGrOdEZDB3yj00T+tkubwqt+/dUhQUj8juwyPs55WMb/0BIbapaoQ6QOP13CaXDV
+    ZmAfsEEIBkNxfq7GTr/z0Rq0B4+9FxAf3Jrsmi/dYoFD/prHsvBDkYw1daoFyp5C
+    tbctvB9wtphnCCynekt8UBvpVKHUU/xaUa09TQTToXjBbV1SZeIOHNG0MNbWa4sz
+    AL/cpXdq1EAxiTeAVT9XhCwhe/xJvFZIWuFLmW3J+ZxrOUCKieCYpTqBY2tBkkDY
+    //egic787yTR6zxqQNSzvNU5LhzrN7lu+KHGM06T35+HvpzgPPiRCzsxO62p63op
+    mq04K31yYZgLiqeAj5W+rioRGJNn4TXJpH9KIrzmGM7lVWLYWMAKeZU4r1lDUdcu
+    7jsBH8BRJWJeVK3xVw2HB3lk7Xn0WrR92adeYQ3f0vKbMIAVUnSJ3yCKJ4NMFSki
+    j78nx2mi/G0RhUPGZ9hhLXQKj9BtbpEnwpbGWtf0ShtVOxD/HKLCr7koBtW9TMPS
+    9K0sJhE5VjsQLkDDu9p3GdRcuLNA/oa7xFvRFtqGFsLj
+    -----END CERTIFICATE-----

apps/django/wb/kustomization.yaml

@@ -0,0 +1,20 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: django
+resources:
+  - django-configmap.yaml
+  - uwsgi-configmap.yaml
+  - zitadel-configmap.yaml
+  - nginx-configmap.yaml
+  - kafka-cert-configmap.yaml
+  - backend.yaml
+  - celery.yaml
+  - export-project.yaml
+  - frontend.yaml
+  - gatekeeper.yaml
+  - measurement.yaml
+  - redis.yaml
+  - s3-proxy.yaml
+  - srx-admin.yaml
+  - auth-flow-frontend.yaml

apps/django/wb/measurement.yaml

@@ -0,0 +1,112 @@
+---
+# measurement — компонент приложения measurements (apps/measurements),
+# в wb развёрнут в ns django, а не в своём собственном неймспейсе.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: measurement
+  namespace: django
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      measurement:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/measurements:prod_ece72657
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: measurement
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: measurement-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: tmp-volume
+              mountPath:
+                _default: /tmp
+              emptyDir: {}
+
+        envs:
+          - name: DJANGO_HOST
+            value:
+              _default: "https://lk.srx.wb.ru:30443"
+
+          - name: S3_JSON_FILE
+            value:
+              _default: "/opt/cred_s3.json"
+
+        secretEnvs:
+          - name: S3_JSON_SETTINGS
+            secretName:
+              _default: "s3-json-settings"
+            secretKey: "S3_JSON_SETTINGS"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/django/wb/nginx-configmap.yaml

@@ -0,0 +1,180 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nginx-configmap
+  namespace: django
+data:
+  nginx.conf: |
+    worker_processes auto;
+
+    pid /var/run/nginx.pid;
+
+    events {
+        use epoll;
+        worker_connections 1024;
+    }
+
+    http {
+
+        # Basic Settings
+        large_client_header_buffers 8 128k;
+        sendfile on;
+        tcp_nopush on;
+        tcp_nodelay on;
+        keepalive_timeout 300;
+        types_hash_max_size 2048;
+        client_max_body_size 5000M;
+        client_header_buffer_size 5M;
+        # server_tokens off;
+        # server_names_hash_bucket_size 64;
+        # server_name_in_redirect off;
+        include /etc/nginx/mime.types;
+        default_type application/octet-stream;
+
+        # Logging Settings
+        access_log /var/log/nginx/access.log;
+        error_log /var/log/nginx/error.log;
+
+        # GZIP Settings
+        gzip on;
+        gzip_vary on;
+        gzip_proxied any;
+        gzip_comp_level 6;
+        gzip_buffers 16 8k;
+        gzip_http_version 1.1;
+        gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
+
+        log_format main '$remote_addr - $remote_user [$time_local] "$request" '
+                        '$status $body_bytes_sent "$http_referer" '
+                        '"$http_user_agent" "$http_x_forwarded_for"';
+
+        server {
+            listen 80;
+            listen [::]:80;
+            root /opt/react_client/;
+
+            add_header 'Access-Control-Allow-Origin' '*' always;
+            add_header 'Access-Control-Allow-Methods' '*' always;
+            add_header 'Access-Control-Allow-Headers' '*' always;
+
+            location = /static/index.bundle.js {
+                add_header Cache-Control 'no-store no-cache, must-revalidate, proxy-revalidate, max-age=0';
+                if_modified_since off;
+                expires off;
+            }
+
+            location = /static/pdf-runtime/assets/mupdf-wasm.wasm {
+                alias /opt/react_client/static/pdf-runtime/assets/mupdf-wasm.wasm;
+                add_header Content-Type application/wasm always;
+                add_header Cache-Control "public, max-age=31536000, immutable" always;
+                add_header Access-Control-Allow-Origin "*" always;
+                add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+                add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
+            }
+
+            location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.js {
+                alias /opt/react_client/static/viewer-pdf/mupdf-wasm.js;
+                add_header Content-Type application/javascript always;
+                add_header Cache-Control "public, max-age=31536000, immutable" always;
+                add_header Access-Control-Allow-Origin "*" always;
+                add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+                add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
+            }
+
+            location = /workspaces-v2/worker/mupdf.worker-3.3.9.js {
+                alias /opt/react_client/static/pdf-runtime/mupdf.worker-3.3.9.js;
+                add_header Content-Type application/javascript always;
+                add_header Cache-Control "public, max-age=31536000, immutable" always;
+                add_header Access-Control-Allow-Origin "*" always;
+                add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+                add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
+            }
+
+            location = /workspaces-v2/worker/static/viewer-pdf/mupdf.js {
+                alias /opt/react_client/static/viewer-pdf/mupdf.js;
+                add_header Content-Type application/javascript always;
+                add_header Cache-Control "public, max-age=31536000, immutable" always;
+                add_header Access-Control-Allow-Origin "*" always;
+                add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+                add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
+            }
+
+            location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.wasm {
+                add_header Content-Type application/wasm always;
+                alias /opt/react_client/static/viewer-pdf/mupdf-wasm.wasm;
+            }
+            location ~^/api/pm/ {
+                #rewrite /api/(.+) /$1 break;
+                proxy_set_header Host $host;
+                proxy_pass http://backend-service.pm.svc.cluster.local:8000;
+            }
+
+            location ~^/media/ {
+                rewrite ^/media/(.*)$ /$1 break;
+                proxy_set_header Host $host;
+                proxy_pass http://s3-proxy-service:80;
+            }
+
+            location ~^/api/v1/documents/ {
+                #rewrite /api/(.+) /$1 break;
+                proxy_set_header Host $host;
+                proxy_pass http://documentations-filestream.documentations.svc.cluster.local:8080;
+            }
+
+            location ~^/(api|admin)/ {
+                proxy_set_header Host $host;
+                proxy_pass http://backend:8000;
+            }
+
+            # location ~^/flows/static/ {
+            #      rewrite /flows/static/(.+) /$1 break;
+            #      proxy_pass http://frontend-service.flows:80;
+            # }
+
+            #  location = ~^/orchestrator/ {
+            # rewrite ^/orchestrator$ /api/ break;
+            # proxy_pass http://cde.orchestrator.svc.cluster.local:8080;
+            # }
+
+            # location = ~^/orchestrator/api/process {
+            #     rewrite ^/orchestrator/api/process$ /api/process break;
+            #     proxy_pass http://cde.orchestrator.svc.cluster.local:8080;
+            # }
+
+            # location ~ ^/orchestrator/api/process/(.*)$ {
+            #     rewrite ^/orchestrator/api/process/(.*)$ /api/process/$1 break;
+            #     proxy_pass http://cde.orchestrator.svc.cluster.local:8080;
+            # }
+
+            # location = ~^/orchestrator/api/sign {
+            #     rewrite ^/orchestrator/api/sign$ /api/sign break;
+            #     proxy_pass http://cde.orchestrator.svc.cluster.local:8080;
+            # }
+
+
+            location ~^/workspaces-v2/(.+).js {
+                rewrite /workspaces-v2/(.+) /$1 break;
+                proxy_pass http://workspaces-v2-frontend-static-service.workspaces.svc.cluster.local:8080;
+            }
+
+            location @index {
+                add_header Cache-Control 'no-cache, must-revalidate, proxy-revalidate, max-age=0';
+                if_modified_since off;
+                expires off;
+                try_files /static/index.html =404;
+            }
+
+            location ~^/workflows/(.+).js {
+                 rewrite /workflows/(.+) /$1 break;
+                 proxy_pass http://frontend-service.workflow.svc.cluster.local:8080;
+            }
+            location /service-worker.js {
+                try_files /static/$uri @index;
+            }
+
+            location / {
+                try_files $uri @index;
+            }
+        }
+    }

apps/django/wb/redis.yaml

@@ -0,0 +1,88 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: redis
+  namespace: django
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      redis:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/redis:latest
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: redis
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 6379
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: redis-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 6379
+
+          targetPort:
+            _default: 6379
+
+          portName:
+            _default: tcp
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/django/wb/s3-proxy.yaml

@@ -0,0 +1,117 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: s3-proxy
+  namespace: django
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      s3-proxy:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/s3-proxy:stable
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: s3-proxy
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: s3-proxy-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        envs:
+          - name: AWS_API_ENDPOINT
+            value:
+              _default: "http://10.49.10.90:9000"
+
+          - name: ACCESS_LOG
+            value:
+              _default: "true"
+
+          - name: CORS_ALLOW_HEADERS
+            value:
+              _default: "Content-Type, Accept-Ranges, Content-Range, Content-Encoding"
+
+        secretEnvs:
+          - name: AWS_ACCESS_KEY_ID
+            secretName:
+              _default: "sarex-media-storage-secret"
+            secretKey: "login"
+
+          - name: AWS_SECRET_ACCESS_KEY
+            secretName:
+              _default: "sarex-media-storage-secret"
+            secretKey: "password"
+
+          - name: AWS_S3_BUCKET
+            secretName:
+              _default: "sarex-media-storage-secret"
+            secretKey: "bucket"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/django/wb/srx-admin.yaml

@@ -0,0 +1,95 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: srx-admin
+  namespace: django
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      srx-admin:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/srx-admin:prod_638c3442
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: srx-admin
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: srx-admin-svc
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8080
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: tmp-volume
+              mountPath:
+                _default: /tmp
+              emptyDir: {}
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/django/wb/uwsgi-configmap.yaml

@@ -0,0 +1,31 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: uwsgi-configmap
+  namespace: django
+data:
+  uwsgi.ini: |
+    [uwsgi]
+    module                 = config.wsgi:application
+    DJANGO_SETTINGS_MODULE = config.settings.production
+    http                   = 0.0.0.0:8000
+    processes              = 16
+    master                 = true
+    vacuum                 = true
+    enable-threads         = true
+    buffer-size            = 65535
+    stats                  = :3031
+    stats-http             = true
+    memory-report          = true
+    lazy-apps              = true
+    listen                 = 128
+    disable-write-exception= 0
+    harakiri               = 300
+    socket-timeout         = 300
+    chunked-input-timeout  = 300
+    http-timeout           = 300
+    worker-reload-mercy    = 240
+    mule-reload-mercy      = 240
+    static-map = /static=/opt/sarex/sarex/static/
+    static-map = /media=/media/

apps/django/wb/zitadel-configmap.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: zitadel-configmap
+  namespace: django
+data:
+  config.json: |-
+    {
+      "auth_type": "zitadel",
+      "zitadel": {
+        "client_id": "363741990556356237",
+        "host": "https://zitadel-srx.wb.ru"
+      }
+    }

apps/documentations/base/pdm.yaml

@@ -64,7 +64,7 @@ spec:
               enabled: false
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/pdmv2:prod_38958427
+            _default: cr.yandex/crp3ccidau046kdj8g9q/pdmv2:prod_9507c2d5
           pullPolicy:
             _default: IfNotPresent
         service:
@@ -183,7 +183,7 @@ spec:
               _default: INFO
           - name: NOTES_URL
             value:
-              _default: ""
+              _default: "mock"
           - name: OBSERVABILITY_COLLECTOR_ENDPOINT
             value:
               _default: temp

apps/documentations/brusnika-prod/api.yaml

@@ -212,6 +212,10 @@ spec:
             value:
               _default: "v1"
 
+          - name: USE_MARKS_RABBITMQ
+            value:
+              _default: "true"
+
           - name: SYSTEM_LOG_URL
             value:
               _default: "http://api-service.system-log.svc.cluster.local:80"
@@ -294,6 +298,32 @@ spec:
               _default: "django-auth"
             secretKey: "key"
           
+          - name: MARKS_RABBITMQ_HOST
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "host"
+          
+          - name: MARKS_RABBITMQ_PASSWORD
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "password"
+          
+          - name: MARKS_RABBITMQ_USER
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "username"
+
+          - name: MARKS_RABBITMQ_API
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "vhost"
+          
+          - name: MARKS_RABBITMQ_PORT
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "port"
+
+
           - name: DJANGO_BASIC_AUTH_FOR_GET_USER
             secretName:
               _default: "django-auth"

apps/documentations/brusnika-prod/hasher.yaml

@@ -0,0 +1,186 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: documentations-hasher
+  namespace: documentations
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+  driftDetection:
+    mode: enabled
+
+  values:
+    global:
+      env: _default
+
+    services:
+      backend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/hasher:production_3f853d3a
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: hasher
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8080
+
+          command:
+            _default: ["run-amqp-server"]
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: hasher-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8080
+
+          targetPort:
+            _default: 8080
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+
+        labels:
+          monitoring: prometheus
+
+        envs:
+          - name: HASHER_APP__LOG_LEVEL
+            value:
+              _default: "INFO"
+
+          - name: HASHER_APP__NUM_WORKERS
+            value:
+              _default: "4"
+
+          - name: HASHER_AMQP__ROUTING__TASK_INPUT_QUEUE
+            value:
+              _default: "hash.compute.normal.tasks"
+
+          - name: HASHER_AMQP__ROUTING__TASK_INPUT_EXCHANGE
+            value:
+              _default: "hash.compute"
+
+          - name: HASHER_AMQP__ROUTING__TASK_INPUT_EXCHANGE_TYPE
+            value:
+              _default: "direct"
+
+          - name: HASHER_AMQP__ROUTING__TASK_INPUT_ROUTING_KEY
+            value:
+              _default: "hash.compute.normal"
+
+          - name: HASHER_S3__MAX_POOL_CONNECTIONS
+            value:
+              _default: "10"
+
+          - name: HASHER_S3__CONNECT_TIMEOUT
+            value:
+              _default: "10"
+
+          - name: HASHER_S3__READ_TIMEOUT
+            value:
+              _default: "30"
+
+          - name: HASHER_S3__REGION_NAME
+            value:
+              _default: "ru-central1"
+
+          - name: HASHER_S3__USE_SSL
+            value:
+              _default: "true"
+
+          - name: HASHER_S3__VERIFY
+            value:
+              _default: "true"
+
+        secretEnvs:
+          - name: HASHER_AMQP__HOST
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "host"
+
+          - name: HASHER_AMQP__PORT
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "port"
+
+          - name: HASHER_AMQP__USERNAME
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "username"
+
+          - name: HASHER_AMQP__PASSWORD
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "password"
+
+          - name: HASHER_AMQP__VHOST
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "vhost"
+
+          - name: HASHER_S3__ENDPOINT
+            secretName:
+              _default: "hasher-s3-secret"
+            secretKey: "endpoint"
+
+          - name: HASHER_S3__ACCESS_KEY
+            secretName:
+              _default: "hasher-s3-secret"
+            secretKey: "access_key"
+
+          - name: HASHER_S3__SECRET_KEY
+            secretName:
+              _default: "hasher-s3-secret"
+            secretKey: "secret_key"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/documentations/brusnika-prod/kustomization.yaml

@@ -7,3 +7,4 @@ resources:
   - pdm.yaml
   - api.yaml
   - filestream.yaml
+  - hasher.yaml

apps/documentations/wb/api.yaml

@@ -0,0 +1,335 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: documentations-api
+  namespace: documentations
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      documentations-api:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_179e518c
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: documentations-api
+
+          replicaCount:
+            _default: 3
+
+          port:
+            _default: 8080
+
+          resources:
+            requests:
+              cpu:
+                _default: 300m
+              memory:
+                _default: 300Mi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: documentations-api
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8080
+
+          targetPort:
+            _default: 8080
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: documentations-yc-s3-secret
+              mountPath:
+                _default: /etc/sarex/yc-s3-storage
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: documentations-yc-s3
+
+            - name: zitadel-account
+              mountPath:
+                _default: /etc/sarex/zitadel
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: zitadel-account
+
+        envs:
+          - name: POSTGRES_ADDRESS
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: POSTGRES_PORT
+            value:
+              _default: "5432"
+
+          - name: POSTGRES_DB
+            value:
+              _default: "documentations_db"
+
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "20"
+
+          - name: ZITADEL_ACCOUNT
+            value:
+              _default: "/etc/sarex/zitadel/zitadel-account.json"
+
+          - name: ZITADEL_DOMAIN
+            value:
+              _default: "zitadel-srx.wb.ru"
+
+          - name: USE_ZITADEL
+            value:
+              _default: "1"
+
+          - name: FLOWS_URL
+            value:
+              _default: "http://backend-service.flows.svc.cluster.local:8000"
+
+          - name: LAST_MASTER_BIM
+            value:
+              _default: "36311"
+
+          - name: API_ADDRESS
+            value:
+              _default: "0.0.0.0:8080"
+
+          - name: API_ADDRESS_FILE
+            value:
+              _default: "0.0.0.0:8080"
+
+          - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES
+            value:
+              _default: "5"
+
+          - name: ENABLE_SQL_QUERY
+            value:
+              _default: "0"
+
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+
+          - name: WORKSPACE_V2_EXTERNAL_URL
+            value:
+              _default: "https://srx.wb.ru/workspaces-v2/"
+
+          - name: ENABLE_S3
+            value:
+              _default: "1"
+
+          - name: CONTAINER_REGISTRY
+            value:
+              _default: "cr.yandex/crp3ccidau046kdj8g9q"
+
+          - name: ENVIRONMENT
+            value:
+              _default: "production"
+
+          - name: LAST_SLAVE_1_BIM
+            value:
+              _default: "1000000"
+
+          - name: HOST
+            value:
+              _default: "http://documentations-api.documentations.svc.cluster.local:8080"
+
+          - name: FILE_STREAM_HOST
+            value:
+              _default: "srx.wb.ru"
+
+          - name: DOCUMENTATION_URL
+            value:
+              _default: "http://documentations-api.documentations.svc.cluster.local:8080/"
+
+          - name: WORKFLOW_URL
+            value:
+              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000/"
+
+          - name: WORKSPACE_URL
+            value:
+              _default: "http://workspaces-service.workspaces.svc.cluster.local:8000/"
+
+          - name: BIM_API_URL
+            value:
+              _default: "http://bim-api-service.bim.svc.cluster.local:8080/"
+
+          - name: BIM_API_V2_URL
+            value:
+              _default: "http://backend-service.bim.svc.cluster.local:8000/"
+
+          - name: WORKSPACE_BUNDLE_VERSION
+            value:
+              _default: "v1"
+
+          - name: SYSTEM_LOG_URL
+            value:
+              _default: "http://api-service.system-log.svc.cluster.local:8000"
+
+          - name: DJANGO_HOST
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+          - name: MARKS_PROCESSING_URL
+            value:
+              _default: "http://marks-service:8000"
+
+          - name: PUBLIC_LINK_HOST
+            value:
+              _default: "https://document-link-srx.wb.ru"
+
+          - name: NAMESPACE
+            value:
+              _default: "documentations"
+
+          - name: DJANGO_ORIGINATOR
+            value:
+              _default: "docs_prod"
+
+          - name: WORKFLOW_IMAGES_VERSION
+            value:
+              _default: "master"
+
+          - name: WORKFLOWS_IMAGES_VERSION
+            value:
+              _default: "master"
+
+          - name: S3_SERVICE_ACCOUNT
+            value:
+              _default: "/etc/sarex/yc-s3-storage/yc-s3-service-account.json"
+
+          - name: READ_WRITE_TIMEOUT_FILE_STREAM
+            value:
+              _default: "6h"
+
+          - name: CACHE_DEFAULT_EXPIRATION
+            value:
+              _default: "60s"
+
+          - name: ENABLE_SMTP
+            value:
+              _default: "True"
+
+          - name: ENABLE_MAILGUN
+            value:
+              _default: "False"
+
+          - name: CACHE_CLEANUP_INTERVAL
+            value:
+              _default: "60s"
+
+          - name: ENABLE_AUTH_JWT_IN_URL
+            value:
+              _default: "false"
+
+          - name: ENABLE_SIGNATURE_IN_URL
+            value:
+              _default: "true"
+
+          - name: USE_CACHE_IN_FILE_STREAMER
+            value:
+              _default: "1"
+
+          - name: VALKEY_ADDR
+            value:
+              _default: "redis:6379"
+
+          - name: VALKEY_HOST
+            value:
+              _default: "redis"
+
+          - name: VALKEY_PORT
+            value:
+              _default: "6379"
+
+        secretEnvs:
+          - name: PUBLIC_KEY
+            secretName:
+              _default: "public-key"
+            secretKey: "key"
+
+          - name: DOCUMENT_PUBLIC_LINK_JWT_SECRET
+            secretName:
+              _default: "yc-jwt-secret"
+            secretKey: "secret"
+
+          - name: POSTGRES_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: POSTGRES_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: DJANGO_BASIC_AUTH
+            secretName:
+              _default: "django-auth"
+            secretKey: "key"
+
+          - name: DJANGO_BASIC_AUTH_FOR_GET_USER
+            secretName:
+              _default: "django-auth"
+            secretKey: "key"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/documentations/wb/filestream.yaml

@@ -0,0 +1,292 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: documentations-filestream
+  namespace: documentations
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      documentations-filestream:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:prod_3f19a21d
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: documentations-filestream
+
+          replicaCount:
+            _default: 3
+
+          port:
+            _default: 8080
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: documentations-filestream
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8080
+
+          targetPort:
+            _default: 8080
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: documentations-yc-s3-secret
+              mountPath:
+                _default: /etc/sarex/yc-s3-storage
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: documentations-yc-s3
+
+            - name: zitadel-account
+              mountPath:
+                _default: /etc/sarex/zitadel
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: zitadel-account
+
+        envs:
+          - name: POSTGRES_ADDRESS
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: POSTGRES_PORT
+            value:
+              _default: "5432"
+
+          - name: POSTGRES_DB
+            value:
+              _default: "documentations_db"
+
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "20"
+
+          - name: API_ADDRESS
+            value:
+              _default: "0.0.0.0:8080"
+
+          - name: API_ADDRESS_FILE
+            value:
+              _default: "0.0.0.0:8080"
+
+          - name: ENABLE_SQL_QUERY
+            value:
+              _default: "0"
+
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+
+          - name: ENABLE_S3
+            value:
+              _default: "1"
+
+          - name: ZITADEL_ACCOUNT
+            value:
+              _default: "/etc/sarex/zitadel/zitadel-account.json"
+
+          - name: ZITADEL_DOMAIN
+            value:
+              _default: "zitadel-srx.wb.ru"
+
+          - name: USE_ZITADEL
+            value:
+              _default: "1"
+
+          - name: CONTAINER_REGISTRY
+            value:
+              _default: "cr.yandex/crp3ccidau046kdj8g9q"
+
+          - name: ENVIRONMENT
+            value:
+              _default: "production"
+
+          - name: HOST
+            value:
+              _default: "http://documentations-service.documentations.svc.cluster.local:8080"
+
+          - name: FILE_STREAM_HOST
+            value:
+              _default: "srx.wb.ru"
+
+          - name: DOCUMENTATION_URL
+            value:
+              _default: "http://documentations-service.documentations.svc.cluster.local:8080/"
+
+          - name: WORKFLOW_URL
+            value:
+              _default: "http://workflows-service.workflow.svc.cluster.local:8000/"
+
+          - name: WORKSPACE_URL
+            value:
+              _default: "http://workspaces-service.workspaces.svc.cluster.local:8000/"
+
+          - name: BIM_API_URL
+            value:
+              _default: "http://bim-api-service.bim.svc.cluster.local:8080/"
+
+          - name: BIM_API_V2_URL
+            value:
+              _default: "http://backend-service.bim.svc.cluster.local:8000/"
+
+          - name: ENABLE_AUTH_JWT_IN_URL
+            value:
+              _default: "false"
+
+          - name: ENABLE_SIGNATURE_IN_URL
+            value:
+              _default: "true"
+
+          - name: WORKSPACE_BUNDLE_VERSION
+            value:
+              _default: "v1"
+
+          - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES
+            value:
+              _default: "5"
+
+          - name: DJANGO_HOST
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+          - name: NAMESPACE
+            value:
+              _default: "sarex-documentations"
+
+          - name: DJANGO_ORIGINATOR
+            value:
+              _default: "docs_prod"
+
+          - name: WORKFLOW_IMAGES_VERSION
+            value:
+              _default: "master"
+
+          - name: WORKFLOWS_IMAGES_VERSION
+            value:
+              _default: "master"
+
+          - name: S3_SERVICE_ACCOUNT
+            value:
+              _default: "/etc/sarex/yc-s3-storage/yc-s3-service-account.json"
+
+          - name: READ_WRITE_TIMEOUT_FILE_STREAM
+            value:
+              _default: "6h"
+
+          - name: CACHE_DEFAULT_EXPIRATION
+            value:
+              _default: "60s"
+
+          - name: CACHE_CLEANUP_INTERVAL
+            value:
+              _default: "60s"
+
+          - name: USE_CACHE_IN_FILE_STREAMER
+            value:
+              _default: "1"
+
+          - name: VALKEY_ADDR
+            value:
+              _default: "redis:6379"
+
+          - name: VALKEY_HOST
+            value:
+              _default: "redis"
+
+          - name: VALKEY_PORT
+            value:
+              _default: "6379"
+
+        secretEnvs:
+          - name: DJANGO_BASIC_AUTH_FOR_GET_USER
+            secretName:
+              _default: "django-auth"
+            secretKey: "key"
+
+          - name: DOCUMENT_PUBLIC_LINK_JWT_SECRET
+            secretName:
+              _default: "yc-jwt-secret"
+            secretKey: "secret"
+
+          - name: POSTGRES_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: POSTGRES_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: DJANGO_BASIC_AUTH
+            secretName:
+              _default: "django-auth"
+            secretKey: "key"
+
+          - name: PUBLIC_KEY
+            secretName:
+              _default: "public-key"
+            secretKey: "key"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/documentations/wb/frontend-public-link.yaml

@@ -0,0 +1,113 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend-public-link
+  namespace: documentations
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      frontend-public-link:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/document-link-frontend:wb_cb2027ce
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: frontend-public-link
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 3000
+
+          command:
+            _default: ["npm", "start"]
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: frontend-service-public-link
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 3000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: envfile
+              mountPath:
+                _default: /app/.env.local
+              subPath:
+                _default: .env.local
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: documentations-publiclink-jwt-secret
+                items:
+                  - key: .env
+                    path:
+                      _default: .env.local
+
+        envs:
+          - name: NODE_ENV
+            value:
+              _default: "production"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/documentations/wb/frontend-static.yaml

@@ -0,0 +1,88 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: documentation-frontend-static
+  namespace: documentations
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      documentation-frontend-static:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentation-frontend-app:brusnika_e5f99d7c
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: documentation-frontend-static
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: documentation-frontend-static-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/documentations/wb/kustomization.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: documentations
+resources:
+  - api.yaml
+  - filestream.yaml
+  - pdm-api.yaml
+  - pdf-markings.yaml
+  - pdf-markings-amqp.yaml
+  - frontend-public-link.yaml
+  - frontend-static.yaml
+  - redis.yaml
+  - stamp-verification.yaml

apps/documentations/wb/pdf-markings-amqp.yaml

@@ -0,0 +1,193 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: pdf-markings-amqp
+  namespace: documentations
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      api:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_3ab263be
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: pdf-markings-amqp
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: false
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: yc-s3
+              mountPath:
+                _default: /etc/sarex/yc-s3-storage
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: yc-s3
+
+        envs:
+          - name: MARKS_APP__LOG_LEVEL
+            value:
+              _default: "INFO"
+
+          - name: MARKS_CRYPTO__HASHING_ALGO
+            value:
+              _default: "md_gost12_256"
+
+          - name: MARKS_DOCUMENTS_DB__HOST
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: MARKS_DOCUMENTS_DB__PORT
+            value:
+              _default: "5432"
+
+          - name: MARKS_DOCUMENTS_DB__DATABASE
+            value:
+              _default: "documentations_db"
+
+          - name: MARKS_DOCUMENTS_DB__SSLMODE
+            value:
+              _default: "disable"
+
+          - name: MARKS_QR__REDIRECT_URL
+            value:
+              _default: "https://stamp-verification-srx.wb.ru/"
+
+          - name: MARKS_QR__BASE_DOCUMENT_URL
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: MARKS_S3__USE_SSL
+            value:
+              _default: "false"
+
+          - name: MARKS_S3__SSL_VERIFY
+            value:
+              _default: "false"
+
+          - name: MARKS_S3__REGION
+            value:
+              _default: "ru-central1"
+
+          - name: MARKS_S3__DEFAULT_BUCKET
+            value:
+              _default: "documentations-stage-1-sarex-new"
+
+          - name: MARKS_RABBITMQ__ROUTING__INPUT_QUEUE
+            value:
+              _default: "pdf_markings_input"
+
+        secretEnvs:
+          - name: MARKS_DOCUMENTS_DB__USERNAME
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: MARKS_DOCUMENTS_DB__PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: MARKS_S3__URL
+            secretName:
+              _default: "yc-s3"
+            secretKey: "endpoint_url"
+
+          - name: MARKS_S3__ACCESS_KEY
+            secretName:
+              _default: "yc-s3"
+            secretKey: "key_id"
+
+          - name: MARKS_S3__SECRET_KEY
+            secretName:
+              _default: "yc-s3"
+            secretKey: "access_key"
+
+          - name: MARKS_RABBITMQ__HOST
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "host"
+
+          - name: MARKS_RABBITMQ__PORT
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "port"
+
+          - name: MARKS_RABBITMQ__USERNAME
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "username"
+
+          - name: MARKS_RABBITMQ__PASSWORD
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "password"
+
+          - name: MARKS_RABBITMQ__VHOST
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "vhost"
+
+          - name: MARKS_RABBITMQ__HEARTBEAT_SECONDS
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "heartbeat"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/documentations/wb/pdf-markings.yaml

@@ -0,0 +1,231 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: pdf-markings
+  namespace: documentations
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      pdf-markings:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings:prod_7d892636
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: pdf-markings
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          resources:
+            requests:
+              cpu:
+                _default: "2"
+              memory:
+                _default: 8Gi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: marks-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: yc-s3
+              mountPath:
+                _default: /etc/sarex/yc-s3-storage
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: documentations-yc-s3
+
+        envs:
+          - name: APP_NAME
+            value:
+              _default: "pdm_v2"
+
+          - name: VERIFY
+            value:
+              _default: "False"
+
+          - name: APP_VERSION
+            value:
+              _default: "0.0.1"
+
+          - name: LOG_LEVEL
+            value:
+              _default: "INFO"
+
+          - name: HTTP_PORT
+            value:
+              _default: "8000"
+
+          - name: DOC_POSTGRES_HOST
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: DOC_POSTGRES_PORT
+            value:
+              _default: "5432"
+
+          - name: DOC_POSTGRES_DB
+            value:
+              _default: "documentations_db"
+
+          - name: DOC_POSTGRES_POOL_SIZE
+            value:
+              _default: "10"
+
+          - name: DOC_POSTGRES_SSL_MODE
+            value:
+              _default: "disable"
+
+          - name: API_ADDRESS
+            value:
+              _default: "0.0.0.0:8000"
+
+          - name: DATABASE_SSL_MODE
+            value:
+              _default: "disable"
+
+          - name: YANDEX_S3_USE_SSL
+            value:
+              _default: "0"
+
+          - name: ENVIRONMENT
+            value:
+              _default: "production"
+
+          - name: YANDEX_S3_ACCOUNT_PATH
+            value:
+              _default: "/etc/sarex/yc-s3-storage/yc-s3-service-account.json"
+
+          - name: REDIRECT_URL_QR
+            value:
+              _default: "https://stamp-verification-srx.wb.ru/"
+
+          - name: BASE_DOCUMENT_URL
+            value:
+              _default: "https://srx.wb.ru"
+
+        secretEnvs:
+          - name: DOC_POSTGRES_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: DOC_POSTGRES_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: YANDEX_S3_ENDPOINT_URL
+            secretName:
+              _default: "yc-s3"
+            secretKey: "endpoint_url"
+
+          - name: YANDEX_S3_SECRET_ACCESS_KEY
+            secretName:
+              _default: "yc-s3"
+            secretKey: "access_key"
+
+          - name: YANDEX_S3_ACCESS_KEY_ID
+            secretName:
+              _default: "yc-s3"
+            secretKey: "key_id"
+
+          - name: RABBITMQ_HOST
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "host"
+
+          - name: RABBITMQ_PORT
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "port"
+
+          - name: RABBITMQ_USERNAME
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "username"
+
+          - name: RABBITMQ_PASSWORD
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "password"
+
+          - name: RABBITMQ_VHOST
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "vhost"
+
+          - name: RABBITMQ_HEARTBEAT
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "heartbeat"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/documentations/wb/pdm-api.yaml

@@ -0,0 +1,346 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: pdm-api
+  namespace: documentations
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      pdm-api:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/pdmv2:prod_9507c2d5
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: pdm-api
+
+          replicaCount:
+            _default: 3
+
+          port:
+            _default: 8080
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: pdm-api
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8080
+
+          targetPort:
+            _default: 8080
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: documentations-yc-s3-secret
+              mountPath:
+                _default: /etc/sarex/yc-s3-storage
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: documentations-yc-s3
+
+        envs:
+          - name: USE_EXPERIMENTAL
+            value:
+              _default: "true"
+
+          - name: API_ADDRESS
+            value:
+              _default: "0.0.0.0:8080"
+
+          - name: API_ADDRESS_FILE
+            value:
+              _default: "0.0.0.0:8080"
+
+          - name: BUCKET_NAME
+            value:
+              _default: "attachments-storage"
+
+          - name: API_HOST_PREFIX
+            value:
+              _default: "/"
+
+          - name: APP_NAME
+            value:
+              _default: "pdm_v2"
+
+          - name: APP_VERSION
+            value:
+              _default: "0.0.1"
+
+          - name: ENABLE_PERMISSIONS_FILTER
+            value:
+              _default: "1"
+
+          - name: PERMISSIONS_FILTER_COMPANIES
+            value:
+              _default: "[1]"
+
+          - name: TRANSMITTALS_ENABLE
+            value:
+              _default: "false"
+
+          - name: DRAWINGS_INTERNAL_URL
+            value:
+              _default: "http://drawings-api-service.drawings.svc.cluster.local:80"
+
+          - name: ATTACHMENTS_URL
+            value:
+              _default: "http://attachments-service.attachments.svc.cluster.local:8000"
+
+          - name: BIM_API_V2_URL
+            value:
+              _default: "http://backend-service.bim.svc.cluster.local:8000/"
+          
+          - name: NOTES_URL
+            value:
+              _default: ""
+
+          - name: BIM_V2_HOST
+            value:
+              _default: "http://backend-service.bim.svc.cluster.local:8000/"
+
+          - name: CACHE_CLEANUP_INTERVAL
+            value:
+              _default: "60s"
+
+          - name: CACHE_DEFAULT_EXPIRATION
+            value:
+              _default: "60s"
+
+          - name: DJANGO_HOST
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+          - name: DJANGO_ORIGINATOR
+            value:
+              _default: "docs_prod"
+
+          - name: DOCUMENTATION_URL
+            value:
+              _default: "http://documentations-api.documentations.svc.cluster.local:8080/"
+
+          - name: EAV_URL
+            value:
+              _default: "http://eav-service.eav.svc.cluster.local:8000"
+
+          - name: ENABLE_OBSERVABILITY
+            value:
+              _default: "false"
+
+          - name: ENABLE_S3
+            value:
+              _default: "1"
+
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+
+          - name: ENVIRONMENT
+            value:
+              _default: "prod"
+
+          - name: FLOWS_URL
+            value:
+              _default: "http://backend-service.flows.svc.cluster.local:8000"
+
+          - name: HEIGHT_THUMB_ATTACHMENTS
+            value:
+              _default: "300"
+
+          - name: HEIGHT_THUMB_STATES
+            value:
+              _default: "73"
+
+          - name: HTTP_PORT
+            value:
+              _default: "8080"
+
+          - name: INSPECTIONS_URL
+            value:
+              _default: "http://inspections-service.inspections.svc.cluster.local:80"
+
+          - name: LOG_LEVEL
+            value:
+              _default: "INFO"
+
+          - name: OBSERVABILITY_COLLECTOR_ENDPOINT
+            value:
+              _default: "temp"
+
+          - name: POSTGRES_ADDRESS
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: POSTGRES_DB
+            value:
+              _default: "documentations_db"
+
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "20"
+
+          - name: TRANSMITTALS_BASE_URL
+            value:
+              _default: "mock"
+
+          - name: POSTGRES_PORT
+            value:
+              _default: "5432"
+
+          - name: READ_WRITE_TIMEOUT_FILE_STREAM
+            value:
+              _default: "6h"
+
+          - name: RELEASES_URL
+            value:
+              _default: "https://gitlab.com"
+
+          - name: REMARKS_URL
+            value:
+              _default: "http://remarks-static-service.remarks.svc.cluster.local:8080/remarks"
+
+          - name: RESOURCES_URL
+            value:
+              _default: "http://iams.iam.svc.cluster.local:8080"
+
+          - name: S3_SERVICE_ACCOUNT
+            value:
+              _default: "/etc/sarex/yc-s3-storage/yc-s3-service-account.json"
+
+          - name: STATES_URL
+            value:
+              _default: "http://workspaces-service.workspaces.svc.cluster.local:8000/"
+
+          - name: SUBSCRIPTIONS_URL
+            value:
+              _default: "http://sarex-subscriptions-service.subscriptions.svc.cluster.local:80"
+
+          - name: SYSTEM_LOG_URL
+            value:
+              _default: "http://api-service.system-log.svc.cluster.local:8000"
+
+          - name: TARGET_URL
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+          - name: USE_CACHE_IN_FILE_STREAMER
+            value:
+              _default: "1"
+
+          - name: USE_SUBSCRIPTIONS
+            value:
+              _default: "false"
+
+          - name: WIDTH_THUMB_ATTACHMENTS
+            value:
+              _default: "300"
+
+          - name: WIDTH_THUMB_STATES
+            value:
+              _default: "120"
+
+          - name: WORKFLOWS_IMAGES_VERSION
+            value:
+              _default: "master"
+
+          - name: WORKFLOW_IMAGES_VERSION
+            value:
+              _default: "master"
+
+          - name: WORKFLOW_URL
+            value:
+              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000/"
+
+          - name: WORKSPACE_BUNDLE_VERSION
+            value:
+              _default: "v1"
+
+          - name: WORKSPACE_URL
+            value:
+              _default: "http://workspaces-service.workspaces.svc.cluster.local:8000/"
+
+        secretEnvs:
+          - name: RELEASES_TOKEN
+            secretName:
+              _default: "releases-token"
+            secretKey: "key"
+
+          - name: POSTGRES_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: POSTGRES_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: DJANGO_BASIC_AUTH
+            secretName:
+              _default: "django-auth"
+            secretKey: "key"
+
+          - name: PUBLIC_KEY
+            secretName:
+              _default: "public-key"
+            secretKey: "key"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/documentations/wb/redis.yaml

@@ -0,0 +1,88 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: redis
+  namespace: documentations
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      redis:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/redis:latest
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: redis
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 6379
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: redis
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 6379
+
+          targetPort:
+            _default: 6379
+
+          portName:
+            _default: tcp
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/documentations/wb/stamp-verification.yaml

@@ -0,0 +1,90 @@
+---
+# stamp-verification — отдельное приложение (apps/stamp-verification),
+# в wb развёрнуто в ns documentations, а не в своём собственном неймспейсе.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: stamp-verification
+  namespace: documentations
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      stamp-verification:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/stamp-verification-frontend:e11a8f90be462fc325ff99c8c35a8a418815c27b
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: stamp-verification
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8080
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: stamp-verification-frontend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8080
+
+          targetPort:
+            _default: 8080
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/drawings/wb/backend.yaml

@@ -0,0 +1,120 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: drawings-api
+  namespace: drawings
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      drawings-api:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/drawings-api:015e68e1b2a3dcc13f0b405e1f761b154a825d24
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: drawings-api
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8080
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: drawings-api-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 8080
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        envs:
+          - name: POSTGRES_ADDRESS
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru:5432"
+
+          - name: POSTGRES_DB
+            value:
+              _default: "drawings_db"
+
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "3"
+
+          - name: API_ADDRESS
+            value:
+              _default: "0.0.0.0:8080"
+
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+
+        secretEnvs:
+          - name: POSTGRES_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: POSTGRES_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/drawings/wb/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: drawings
+resources:
+  - backend.yaml

apps/eav/base/helmrelease.yaml

@@ -93,7 +93,7 @@ spec:
                 _default: 6
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/eav:prod_0fb73247
+            _default: cr.yandex/crp3ccidau046kdj8g9q/eav:prod_0dcebba6
           pullPolicy:
             _default: IfNotPresent
         service:

apps/eav/wb/backend.yaml

@@ -0,0 +1,191 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: eav
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      backend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/eav:prod_0dcebba6
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: backend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: eav-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: django-configmap
+              mountPath:
+                _default: /server/config/settings/production.py
+              subPath:
+                _default: production.py
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: django-configmap
+                items:
+                  - key: production.py
+                    path:
+                      _default: production.py
+
+            - name: kafka-cert-volume
+              mountPath:
+                _default: /usr/local/share/ca-certificates
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: kafka-cert
+
+        envs:
+          - name: KAFKA_USERNAME
+            value:
+              _default: "sarex"
+
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: "/usr/local/share/ca-certificates/kafka.crt"
+
+          - name: KAFKA_HOST
+            value:
+              _default: "wb-stage-kafka-bootstrap.kafka.svc.cluster.local:9093"
+
+          - name: KAFKA_ENABLED
+            value:
+              _default: "False"
+
+          - name: ASSETS_TOPIC
+            value:
+              _default: "sarex"
+
+          - name: DJANGO_SETTINGS_MODULE
+            value:
+              _default: "config.settings.production"
+
+          - name: DJANGO_POSTGRES_HOST
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: DJANGO_POSTGRES_DATABASE
+            value:
+              _default: "eav_db"
+
+          - name: YC_S3_ENDPOINT_URL
+            value:
+              _default: "http://minio-svc.minio.svc.cluster.local:9000"
+
+          - name: YC_S3_BUCKET_NAME
+            value:
+              _default: "eav"
+
+        secretEnvs:
+          - name: KAFKA_PASSWORD
+            secretName:
+              _default: "kafka-cred"
+            secretKey: "password"
+
+          - name: DJANGO_POSTGRES_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: DJANGO_POSTGRES_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: JWT_PRIVATE_KEY
+            secretName:
+              _default: "backend-secret"
+            secretKey: "ssh_private.key"
+
+          - name: JWT_PUBLIC_KEY
+            secretName:
+              _default: "backend-secret"
+            secretKey: "ssh_public.key"
+
+          - name: YC_S3_ACCESS_KEY_ID
+            secretName:
+              _default: "s3-secret"
+            secretKey: "login"
+
+          - name: YC_S3_SECRET_ACCESS_KEY
+            secretName:
+              _default: "s3-secret"
+            secretKey: "password"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/eav/wb/django-configmap.yaml

@@ -0,0 +1,147 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: django-configmap
+  namespace: eav
+data:
+  production.py: |
+    # production.py
+
+    from .base import *
+    from datetime import timedelta
+    import os
+    from django.core.exceptions import ImproperlyConfigured
+
+    INSTALLED_APPS.append("corsheaders")
+    #MIDDLEWARE = ["corsheaders.middleware.CorsMiddleware"] + MIDDLEWARE
+
+    # DEBUG SETTINGS START
+    # ---------------------------------------------------------------------------------------------------------------------
+    DEBUG = True
+    ALLOWED_HOSTS = ['*']
+    # ---------------------------------------------------------------------------------------------------------------------
+    # DEBUG SETTINGS END
+
+    # DATABASE SETTINGS START
+    # ---------------------------------------------------------------------------------------------------------------------
+    DATABASES = {
+        "default": {
+            "ENGINE": "django.db.backends.postgresql",
+            "NAME": os.getenv("DJANGO_POSTGRES_DATABASE"),
+            "USER": os.getenv("DJANGO_POSTGRES_USER"),
+            "PASSWORD": os.getenv("DJANGO_POSTGRES_PASSWORD"),
+            "HOST": os.getenv("DJANGO_POSTGRES_HOST"),
+            "PORT": "5432",
+        }
+    }
+    # ---------------------------------------------------------------------------------------------------------------------
+    # DATABASE SETTINGS END
+
+    # RESPONSE HEADERS START
+    # ---------------------------------------------------------------------------------------------------------------------
+    CORS_ORIGIN_ALLOW_ALL = True
+
+    CORS_ALLOWED_ORIGINS = [
+        "https://srx.wb.ru",
+    ]
+
+    CORS_TRUSTED_ORIGINS = [
+        "https://srx.wb.ru",
+    ]
+
+    CSRF_TRUSTED_ORIGINS = [
+        "https://srx.wb.ru",
+    ]
+
+    CORS_ALLOW_METHODS = (
+        'DELETE',
+        'GET',
+        'OPTIONS',
+        'PATCH',
+        'POST',
+        'PUT',
+    )
+
+    CORS_ALLOW_HEADERS = (
+        'accept',
+        'accept-encoding',
+        'authorization',
+        'content-type',
+        'user-agent',
+        'x-csrftoken',
+        'x-requested-with',
+        'x-token',
+        'Bearer'
+    )
+    # ---------------------------------------------------------------------------------------------------------------------
+    # RESPONSE HEADERS END
+
+    REST_FRAMEWORK = {
+        "DEFAULT_PAGINATION_CLASS": (
+            "rest_framework.pagination.LimitOffsetPagination"
+        ),
+        "DEFAULT_SCHEMA_CLASS": "rest_framework.schemas.coreapi.AutoSchema",
+        "PAGE_SIZE": 10000,
+        "DEFAULT_FILTER_BACKENDS": [
+            "django_filters.rest_framework.DjangoFilterBackend"
+        ],
+        "DEFAULT_AUTHENTICATION_CLASSES": [
+            "core.auth.ZitadelJWTAuthentication",
+            "rest_framework_simplejwt.authentication.JWTAuthentication",
+            "rest_framework.authentication.SessionAuthentication",
+            "rest_framework.authentication.BasicAuthentication",
+        ],
+        "DEFAULT_PERMISSION_CLASSES": [
+            "rest_framework.permissions.AllowAny",
+        ]
+    }
+
+    # JWT SETTINGS START
+    # ---------------------------------------------------------------------------------------------------------------------
+    def get_env_variable(var_name, default=None):
+        try:
+            return os.getenv(var_name, default)
+        except KeyError:
+            error_msg = f"Set the {var_name} environment variable"
+            if default:
+                return default
+            raise ImproperlyConfigured(error_msg)
+
+    SIMPLE_JWT_ISSUER = get_env_variable("SIMPLE_JWT_ISSUER", default="django")
+
+    SIMPLE_JWT = {
+        "ACCESS_TOKEN_LIFETIME": timedelta(minutes=5),
+        "REFRESH_TOKEN_LIFETIME": timedelta(days=1),
+        "ROTATE_REFRESH_TOKENS": False,
+        "UPDATE_LAST_LOGIN": False,
+
+        "ALGORITHM": "RS512",
+        "SIGNING_KEY": get_env_variable("JWT_PRIVATE_KEY").replace("\\\n", "\n"),
+        "VERIFYING_KEY": get_env_variable("JWT_PUBLIC_KEY").replace("\\\n", "\n"),
+        "AUDIENCE": None,
+        "ISSUER": SIMPLE_JWT_ISSUER,
+
+        "AUTH_HEADER_TYPES": ("Bearer",),
+        "AUTH_HEADER_NAME": "HTTP_AUTHORIZATION",
+        "USER_ID_FIELD": "id",
+        "USER_ID_CLAIM": "user_id",
+
+        "AUTH_TOKEN_CLASSES": ("rest_framework_simplejwt.tokens.AccessToken",),
+        "TOKEN_TYPE_CLAIM": "token_type",
+
+        "JTI_CLAIM": "jti",
+
+        "SLIDING_TOKEN_REFRESH_EXP_CLAIM": "refresh_exp",
+        "SLIDING_TOKEN_LIFETIME": timedelta(minutes=5),
+        "SLIDING_TOKEN_REFRESH_LIFETIME": timedelta(days=1),
+    }
+    # ---------------------------------------------------------------------------------------------------------------------
+    # JWT SETTINGS END
+
+    STATIC_ROOT = '/static/'
+    STATIC_URL = '/static/'
+    STATICFILES_STORAGE = 'django.contrib.staticfiles.storage.StaticFilesStorage'
+
+    SESSION_COOKIE_NAME = 'eav-sessionid'
+    CSRF_COOKIE_NAME = 'eav-csrftoken'

apps/eav/wb/kafka-cert-configmap.yaml

@@ -0,0 +1,38 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kafka-cert
+  namespace: eav
+data:
+  kafka.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIIFLTCCAxWgAwIBAgIUA5L48eHPMqNFYE5wIgaOmWgG3okwDQYJKoZIhvcNAQEN
+    BQAwLTETMBEGA1UECgwKaW8uc3RyaW16aTEWMBQGA1UEAwwNY2x1c3Rlci1jYSB2
+    MDAeFw0yNTA2MDQxMTMzMTRaFw0yNjA2MDQxMTMzMTRaMC0xEzARBgNVBAoMCmlv
+    LnN0cmltemkxFjAUBgNVBAMMDWNsdXN0ZXItY2EgdjAwggIiMA0GCSqGSIb3DQEB
+    AQUAA4ICDwAwggIKAoICAQDV2NBVwnXISH9i8K4KxSd2AThwgQyRKyeIfcqeYZ4F
+    7FguEUI7uEtoWd4uO8DsIzoMoLYv5L1DfhNYUFWN3XYQd4XVFnwYQYbwspdC1L8G
+    u0T7943gRRRomcNP8n5nycfeZgZgmz9IS8vmxgRh4ao0kcCW49uBQMd706087UAI
+    qaRJTcabTZq1LTeoH9AOAyT/nawKm+1H5VmrMUBjzz9xKVXF0sCrhjYoZoM4x+fY
+    AphtxZDB21ZhEcHBbytEQkEm0QTbUP4xbu95yqY6goYi9S9R1uMgVZ9DoJVwyqLm
+    /3ZGPjd9VmdBPO/zE/Bj890DjyKS7AXo9d+Iyv4M2QD1jA+5j4JyHzk7Lroz+HTg
+    mwVpcVGafBWIC4qFt7C3UYt6IV64/MA2v9gxTIdJvOBZxKUiMl7f65jKNEntF6is
+    86QCkjhvt34AThEoGx8SPjVr3sOBuneqcybeSYLyEWFg9Z1mWfMLHlA/Fp/Y2wpM
+    w1ZXj6uAa/UNUAIfkaLTOKHHaCCVD2G3Vkm94NHOJmDj6ze8P0J0H+Ub6ULD7hHr
+    8obOSk9OvxoxVzE+UW7DyEL6YD8MBVUQKJIQVgZmpT4akWyz8bNhFRzgTnKAhwNN
+    ATrGmjfX/wj7tCpy/PoJjEiu54sXW5xplBIz/ZgYHrPkyrbhQxsRozgQ+UIMIIbJ
+    /wIDAQABo0UwQzAdBgNVHQ4EFgQUkU4HKndgWxhcXMAe5XBc4OJwSgcwEgYDVR0T
+    AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQENBQADggIB
+    AFLi5QLawZollou3+m5kYcBe5F8xKG5NlgNmKyIREnwD2AP4xrr2tNFbmP2hpEl4
+    bWJJ84IHlKjpYxFLboWzgtW/JvdxcEh0K/x8/7cOD3Kk9d/LR9muj57mFYSQGlbo
+    g0+lHNuLam8xGcnGVV5VdfcjFz72/q92ndTlJmz+v6OneTJvIypKoBmNKF25alz9
+    pR2sTwoG0Pcwm30u/uS6pOewQ4sTiniOcc1MFYF7tl/Zz9Mqza8Rer0B5nm8lE/J
+    Yo9UaEXyVLM8Y5kSOkxMlOK+8/UMeY/lcQYpd5tYVpvarnoPCjmUjt4iVw26ZsAH
+    y4/vNW+wX+Uauarik1jHL/SauAjS3FbJoH06BBnji7J/Rud2DtSd+vVZrIBLJkaH
+    +Xg/roD3xKx0XmhLJmPvxGrkyehbhkbJkPKCHa9P56rnev3MYjyy+SV7Vp8Dq+HF
+    Wkswl3QUPWx9reuvF2KMyt04Tw94UAxCUGkX5qg7Dq5d0Fj/AcIrFdLTCV8eG/UI
+    1kKRxmZ2/ALINBOlfJOVVovKBlWpPACs8iy6XreOXtoQfzoG2F9Vo3Jmzjpqsmz0
+    9Ao4s2vcz3UuDtBhpwGp4N3zroyst/kQjtZirj4cS7fu75tB5N5mQ/tTwg0Tiw+Y
+    XIdxeE73V5DAf4Dd5V1VdCbA6oQv5qJYvinYydyx4x3V
+    -----END CERTIFICATE-----

apps/eav/wb/kustomization.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: eav
+resources:
+  - django-configmap.yaml
+  - kafka-cert-configmap.yaml
+  - backend.yaml

apps/faas/wb/backend.yaml

@@ -0,0 +1,145 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: export-reviews
+  namespace: faas
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      export-reviews:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/export-reviews:prod_c4cae4ee
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: export-reviews
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: export-reviews-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        envs:
+          - name: BASE_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: DJANGO_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: REVIEWS_HOST
+            value:
+              _default: "https://srx.wb.ru/flows"
+
+          - name: GATEWAY_HOST
+            value:
+              _default: "https://srx.wb.ru/gateway"
+
+          - name: DOCUMENTATIONS_HOST
+            value:
+              _default: "https://srx.wb.ru/documentations"
+
+          - name: EAV_HOST
+            value:
+              _default: "http://eav-service.eav.svc.cluster.local:8000"
+
+          - name: TRANSMITTALS_INTERNAL_HOST
+            value:
+              _default: "http://transmittal-service.transmittal.svc.cluster.local:80/internal/v1"
+
+          - name: DJANGO_TIMEOUT
+            value:
+              _default: "180"
+
+          - name: REVIEWS_TIMEOUT
+            value:
+              _default: "180"
+
+          - name: GATEWAY_TIMEOUT
+            value:
+              _default: "60"
+
+          - name: DOCUMENTATIONS_TIMEOUT
+            value:
+              _default: "60"
+
+          - name: EAV_TIMEOUT
+            value:
+              _default: "30"
+
+          - name: TRANSMITTALS_TIMEOUT
+            value:
+              _default: "30"
+
+          - name: TIMEOUT
+            value:
+              _default: "180"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/faas/wb/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: faas
+resources:
+  - backend.yaml

apps/flows/wb/authentication-configmap.yaml

@@ -0,0 +1,93 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: authentication
+  namespace: flows
+data:
+  authentication.py: |
+    import httpx
+
+    from fastapi import Request, status
+    from itsdangerous import URLSafeTimedSerializer, BadData as BadDataError
+    from sqladmin.authentication import AuthenticationBackend
+
+    from flow.config import settings
+
+
+    class AdminAuthentication(AuthenticationBackend):
+        def get_serializer(self) -> URLSafeTimedSerializer:
+            return URLSafeTimedSerializer(
+                secret_key=settings.admin_panel.secret_key,
+            )
+
+        async def login(self, request: Request) -> bool:
+            form = await request.form()
+            username, password = form["username"], form["password"]
+            token_payload = {
+                    'is_django_user': False,
+                    'user_id': None,
+                }
+            # получаем данные о юзере
+            if True:
+                #print("OK"*30)
+                # client: httpx.AsyncClient = settings.django.get_async_session(token=settings.django.token)
+                # async with client as session:
+                #     auth_response = await session.post(url='/login/', json={
+                #         'username': username,
+                #         'password': password,
+                #     }, follow_redirects=False)
+                #     print("*"*30, auth_response.status_code ,settings.django.host, username, password,"*"*30)
+                #     if auth_response.status_code != status.HTTP_200_OK:
+                #         return False
+
+                    # django_response = await session.get(url='/client/settings/')
+                    # print("$"*30, django_response.status_code, "$"*30)
+                    # if django_response.status_code != status.HTTP_200_OK:
+                    #     return False
+                    if username == "68Lvh2PsHd5y" and password == "Hnzvh2PsHd5yI1v":
+                        #user = django_response.json()
+                        has_access = True
+                        if not has_access:
+                            return False
+
+                        user_id = 2
+
+                        token_payload = {
+                            'is_django_user': True,
+                            'user_id': user_id,
+                        }
+            else:
+                token_payload = {
+                    'is_django_user': False,
+                    'user_id': None,
+                }
+
+            token = self.get_serializer().dumps(token_payload)
+
+            request.session.update({"token": token})
+            return True
+
+        async def logout(self, request: Request) -> bool:
+            request.session.clear()
+            return True
+
+        async def authenticate(self, request: Request) -> bool:
+            token = request.session.get("token")
+
+            if not token:
+                return False
+
+            try:
+                payload = self.get_serializer().loads(token, max_age=settings.admin_panel.token_max_age)
+            except (BadDataError, KeyError):
+                return False
+
+            is_django_user = payload.get('is_django_user')
+            if settings.django.use != is_django_user:
+                return False
+
+            return True
+
+
+    authentication_backend = AdminAuthentication(secret_key=settings.admin_panel.secret_key)

apps/flows/wb/backend.yaml

@@ -0,0 +1,357 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: flows
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      backend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_a7dc8216
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: backend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: backend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: authentication
+              mountPath:
+                _default: /opt/src/flow/admin/authentication.py
+              subPath:
+                _default: authentication.py
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: authentication
+                items:
+                  - key: authentication.py
+                    path:
+                      _default: authentication.py
+
+            - name: kafka-configmap
+              mountPath:
+                _default: /opt/src/flow/kafka.py
+              subPath:
+                _default: kafka.py
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: kafka-configmap
+                items:
+                  - key: kafka.py
+                    path:
+                      _default: kafka.py
+
+        envs:
+          - name: KAFKA_HOST
+            value:
+              _default: "wb-prod-kafka-bootstrap.kafka.svc.cluster.local:9093"
+
+          - name: KAFKA_SSL_CERT
+            value:
+              _default: |
+                -----BEGIN CERTIFICATE-----
+                MIIFLTCCAxWgAwIBAgIUYDZPxGRsr7IiqHEmfd07QTQlOKYwDQYJKoZIhvcNAQEN
+                BQAwLTETMBEGA1UECgwKaW8uc3RyaW16aTEWMBQGA1UEAwwNY2x1c3Rlci1jYSB2
+                MDAeFw0yNTEyMTYxNDM0NTVaFw0yNjEyMTYxNDM0NTVaMC0xEzARBgNVBAoMCmlv
+                LnN0cmltemkxFjAUBgNVBAMMDWNsdXN0ZXItY2EgdjAwggIiMA0GCSqGSIb3DQEB
+                AQUAA4ICDwAwggIKAoICAQCfzDZhEzw2pbU5Xpu8OzD+3iQG+DVjU8PQWWQEF27h
+                yjohDkUr3zCZtW7xMKWKUNxBgrKsfe4TDOQN8cij3cS9sy0So+UhMeF7Bq9PU1Yd
+                bmTRq8q1PiuNUkiCGJ5wrb3+NZvVxZLJUIFgiealsRw80MgMWWSzy0I35T2Edn/a
+                DU4jhlgQxyzQ621+oGP0n28gCjmm6pCq2tkj/Z8WTdu1gOWyRdK02a2uE2Ts2nLa
+                Di32GaZrIbIuD/WUd6Ek66uCeJvh2CT7s+SqgtMbtT7gibUuPQ3hk1VGQsjy22l3
+                hUNpLu86nrwbuf21mY55KnLOcaVq1ag1TpIIKfZAL/KWFCGZ6H6kwEIbCAL0Hei7
+                cJ2Wm2/qlzKUeU869M7YybZAfXl/t6XT4QgFgje+42N980vy5A4GhWi1Z7lPqqOe
+                jPGBstkRZybKz1sTk87+oJx82iQU/ozVmzjSEK1SoYRNbvug8PNpxmPoPnJ2flgG
+                t2q2+2ZQP3f1aAHVcZ3U5+hWlRmKPXzjrJv7gnhuvqJl7OwB50y+yWiVfZ9xrYl2
+                EpX+yHuFFK+9NnB5taUK8Fz+hQaLU8J4q7P0bRqkoI+LdcEErjuDT/eI2d5+Ql8K
+                /JkV823hX2WNB9bdaQ24BelVUbsxGpR7ms6KWrM11kHnbzUlEM+AxZES6F7Qbr55
+                TwIDAQABo0UwQzAdBgNVHQ4EFgQUM7hshx7e9TFEN82Pf446aBrJUA4wEgYDVR0T
+                AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQENBQADggIB
+                AFNHFGPDxY966fz0dxDFFSfeo47y7XQZMK9xAwH73cQoSeqx+IMxzgM8nfJQ9XMN
+                PeLwVRZ7pvRee2ZhUPglBSTHnW2rvfmLBOO9xyKZxRsCkoFxuHH9xfM7bFWb96R6
+                fGrOdEZDB3yj00T+tkubwqt+/dUhQUj8juwyPs55WMb/0BIbapaoQ6QOP13CaXDV
+                ZmAfsEEIBkNxfq7GTr/z0Rq0B4+9FxAf3Jrsmi/dYoFD/prHsvBDkYw1daoFyp5C
+                tbctvB9wtphnCCynekt8UBvpVKHUU/xaUa09TQTToXjBbV1SZeIOHNG0MNbWa4sz
+                AL/cpXdq1EAxiTeAVT9XhCwhe/xJvFZIWuFLmW3J+ZxrOUCKieCYpTqBY2tBkkDY
+                //egic787yTR6zxqQNSzvNU5LhzrN7lu+KHGM06T35+HvpzgPPiRCzsxO62p63op
+                mq04K31yYZgLiqeAj5W+rioRGJNn4TXJpH9KIrzmGM7lVWLYWMAKeZU4r1lDUdcu
+                7jsBH8BRJWJeVK3xVw2HB3lk7Xn0WrR92adeYQ3f0vKbMIAVUnSJ3yCKJ4NMFSki
+                j78nx2mi/G0RhUPGZ9hhLXQKj9BtbpEnwpbGWtf0ShtVOxD/HKLCr7koBtW9TMPS
+                9K0sJhE5VjsQLkDDu9p3GdRcuLNA/oa7xFvRFtqGFsLj
+                -----END CERTIFICATE-----
+
+          - name: LOG_LEVEL
+            value:
+              _default: "DEBUG"
+
+          - name: BASE_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: CELERY_QUEUE
+            value:
+              _default: "flow"
+
+          - name: EAV_HOST
+            value:
+              _default: "http://eav-service.eav.svc.cluster.local:8000"
+
+          - name: DJANGO_HOST
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000/api"
+
+          - name: PLANNING_HOST
+            value:
+              _default: "http://backend-service.pm.svc.cluster.local:8000/api/pm/msp"
+
+          - name: PLANNING_USE
+            value:
+              _default: "True"
+
+          - name: DOCUMENTATION_HOST
+            value:
+              _default: "http://documentations-api.documentations.svc.cluster.local:8080/internal/v1"
+
+          - name: DOCUMENTATION_EXTERNAL_HOST
+            value:
+              _default: "http://documentations-api.documentations.svc.cluster.local:8080/api/v1"
+
+          - name: ENABLE_ANALYTICS
+            value:
+              _default: "1"
+
+          - name: ENABLE_CELERY
+            value:
+              _default: "1"
+
+          - name: ENABLE_MAILGUN
+            value:
+              _default: "0"
+
+          - name: ENABLE_METRICS
+            value:
+              _default: "0"
+
+          - name: FROM_EMAIL
+            value:
+              _default: "sarex@rwb.ru"
+
+          - name: GATEWAY_URL
+            value:
+              _default: "http://pdm-api.documentations.svc.cluster.local:8080"
+
+          - name: PG_HOST
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: PG_PORT
+            value:
+              _default: "5432"
+
+          - name: RABBITMQ_HOST
+            value:
+              _default: "rabbitmq.rabbitmq.svc.cluster.local"
+
+          - name: RABBITMQ_PORT
+            value:
+              _default: "5672"
+
+          - name: RESOURCE_URL
+            value:
+              _default: "http://iams.iam.svc.cluster.local:8080"
+
+          - name: SERVICE_HOST
+            value:
+              _default: "https://srx.wb.ru/flows/api/v1"
+
+          - name: SMTP_HOST
+            value:
+              _default: "mail.rwb.ru"
+
+          - name: DOCUMENTATION_PG_PORT
+            value:
+              _default: "5432"
+
+          - name: PROXY_PATH_PREFIX
+            value:
+              _default: "/flows"
+
+          - name: DOCUMENTATION_PG_DATABASE
+            value:
+              _default: "documentations_db"
+
+          - name: DOCUMENTATION_PG_HOST
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: CHECKLIST_HOST
+            value:
+              _default: "http://checklists-backend-service.checklists.svc.cluster.local:80"
+
+          - name: SMTP_PORT
+            value:
+              _default: "465"
+
+          - name: SYNC_RESOURCE_ID
+            value:
+              _default: "1"
+
+          - name: TIMEOUT
+            value:
+              _default: "120"
+
+          - name: WORKFLOWS_HOST
+            value:
+              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000/api/v1"
+
+          - name: WORKFLOWS_TIMEOUT
+            value:
+              _default: "60"
+
+          - name: DOCUMENTATION_TIMEOUT
+            value:
+              _default: "60"
+
+        secretEnvs:
+          - name: ADMIN_PANEL_SECRET_KEY
+            secretName:
+              _default: "admin-secret"
+            secretKey: "key"
+
+          - name: JWT_PUBLIC_KEY
+            secretName:
+              _default: "jwt-secret"
+            secretKey: "public_key"
+
+          - name: DOCUMENTATION_PG_USERNAME
+            secretName:
+              _default: "postgres-secret-documentations"
+            secretKey: "username"
+
+          - name: DOCUMENTATION_PG_PASSWORD
+            secretName:
+              _default: "postgres-secret-documentations"
+            secretKey: "password"
+
+          - name: DJANGO_TOKEN
+            secretName:
+              _default: "django-secret"
+            secretKey: "token"
+
+          - name: PG_DB
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "database"
+
+          - name: PG_LOGIN
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: PG_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: RABBITMQ_USERNAME
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "username"
+
+          - name: RABBITMQ_PASSWORD
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "password"
+
+          - name: RABBITMQ_VHOST
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "vhost"
+
+          - name: KAFKA_USERNAME
+            secretName:
+              _default: "kafka-secret"
+            secretKey: "username"
+
+          - name: KAFKA_PASSWORD
+            secretName:
+              _default: "kafka-secret"
+            secretKey: "password"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/flows/wb/celery.yaml

@@ -0,0 +1,373 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: celery
+  namespace: flows
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      celery:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_a7dc8216
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: celery
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          command:
+            _default: ["celery", "-A", "src.worker", "worker", "-l", "INFO", "-E", "--concurrency=1", "-Q", "flow"]
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: false
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: kafka-configmap
+              mountPath:
+                _default: /opt/src/flow/kafka.py
+              subPath:
+                _default: kafka.py
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: kafka-configmap
+                items:
+                  - key: kafka.py
+                    path:
+                      _default: kafka.py
+
+        envs:
+          - name: KAFKA_HOST
+            value:
+              _default: "wb-prod-kafka-bootstrap.kafka.svc.cluster.local:9093"
+
+          - name: KAFKA_SSL_CERT
+            value:
+              _default: |
+                -----BEGIN CERTIFICATE-----
+                MIIFLTCCAxWgAwIBAgIUYDZPxGRsr7IiqHEmfd07QTQlOKYwDQYJKoZIhvcNAQEN
+                BQAwLTETMBEGA1UECgwKaW8uc3RyaW16aTEWMBQGA1UEAwwNY2x1c3Rlci1jYSB2
+                MDAeFw0yNTEyMTYxNDM0NTVaFw0yNjEyMTYxNDM0NTVaMC0xEzARBgNVBAoMCmlv
+                LnN0cmltemkxFjAUBgNVBAMMDWNsdXN0ZXItY2EgdjAwggIiMA0GCSqGSIb3DQEB
+                AQUAA4ICDwAwggIKAoICAQCfzDZhEzw2pbU5Xpu8OzD+3iQG+DVjU8PQWWQEF27h
+                yjohDkUr3zCZtW7xMKWKUNxBgrKsfe4TDOQN8cij3cS9sy0So+UhMeF7Bq9PU1Yd
+                bmTRq8q1PiuNUkiCGJ5wrb3+NZvVxZLJUIFgiealsRw80MgMWWSzy0I35T2Edn/a
+                DU4jhlgQxyzQ621+oGP0n28gCjmm6pCq2tkj/Z8WTdu1gOWyRdK02a2uE2Ts2nLa
+                Di32GaZrIbIuD/WUd6Ek66uCeJvh2CT7s+SqgtMbtT7gibUuPQ3hk1VGQsjy22l3
+                hUNpLu86nrwbuf21mY55KnLOcaVq1ag1TpIIKfZAL/KWFCGZ6H6kwEIbCAL0Hei7
+                cJ2Wm2/qlzKUeU869M7YybZAfXl/t6XT4QgFgje+42N980vy5A4GhWi1Z7lPqqOe
+                jPGBstkRZybKz1sTk87+oJx82iQU/ozVmzjSEK1SoYRNbvug8PNpxmPoPnJ2flgG
+                t2q2+2ZQP3f1aAHVcZ3U5+hWlRmKPXzjrJv7gnhuvqJl7OwB50y+yWiVfZ9xrYl2
+                EpX+yHuFFK+9NnB5taUK8Fz+hQaLU8J4q7P0bRqkoI+LdcEErjuDT/eI2d5+Ql8K
+                /JkV823hX2WNB9bdaQ24BelVUbsxGpR7ms6KWrM11kHnbzUlEM+AxZES6F7Qbr55
+                TwIDAQABo0UwQzAdBgNVHQ4EFgQUM7hshx7e9TFEN82Pf446aBrJUA4wEgYDVR0T
+                AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQENBQADggIB
+                AFNHFGPDxY966fz0dxDFFSfeo47y7XQZMK9xAwH73cQoSeqx+IMxzgM8nfJQ9XMN
+                PeLwVRZ7pvRee2ZhUPglBSTHnW2rvfmLBOO9xyKZxRsCkoFxuHH9xfM7bFWb96R6
+                fGrOdEZDB3yj00T+tkubwqt+/dUhQUj8juwyPs55WMb/0BIbapaoQ6QOP13CaXDV
+                ZmAfsEEIBkNxfq7GTr/z0Rq0B4+9FxAf3Jrsmi/dYoFD/prHsvBDkYw1daoFyp5C
+                tbctvB9wtphnCCynekt8UBvpVKHUU/xaUa09TQTToXjBbV1SZeIOHNG0MNbWa4sz
+                AL/cpXdq1EAxiTeAVT9XhCwhe/xJvFZIWuFLmW3J+ZxrOUCKieCYpTqBY2tBkkDY
+                //egic787yTR6zxqQNSzvNU5LhzrN7lu+KHGM06T35+HvpzgPPiRCzsxO62p63op
+                mq04K31yYZgLiqeAj5W+rioRGJNn4TXJpH9KIrzmGM7lVWLYWMAKeZU4r1lDUdcu
+                7jsBH8BRJWJeVK3xVw2HB3lk7Xn0WrR92adeYQ3f0vKbMIAVUnSJ3yCKJ4NMFSki
+                j78nx2mi/G0RhUPGZ9hhLXQKj9BtbpEnwpbGWtf0ShtVOxD/HKLCr7koBtW9TMPS
+                9K0sJhE5VjsQLkDDu9p3GdRcuLNA/oa7xFvRFtqGFsLj
+                -----END CERTIFICATE-----
+
+          - name: LOG_LEVEL
+            value:
+              _default: "DEBUG"
+
+          - name: FLOWS_HOST
+            value:
+              _default: "http://backend-service.flows.svc.cluster.local:8000"
+
+          - name: DOCUMENTATION_PG_PORT
+            value:
+              _default: "5432"
+
+          - name: DOCUMENTATION_PG_DATABASE
+            value:
+              _default: "documentations_db"
+
+          - name: DOCUMENTATION_PG_HOST
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: BASE_HOST
+            value:
+              _default: "https://lk.srx.wb.ru:30443"
+
+          - name: CELERY_QUEUE
+            value:
+              _default: "flow"
+
+          - name: RESOURCES_HOST
+            value:
+              _default: "http://resources-service.resources.svc.cluster.local:8000/"
+
+          - name: DJANGO_HOST
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000/api"
+
+          - name: DOCUMENTATION_HOST
+            value:
+              _default: "http://documentations-api.documentations.svc.cluster.local:8080/internal/v1"
+
+          - name: DOCUMENTATION_EXTERNAL_HOST
+            value:
+              _default: "http://documentations-api.documentations.svc.cluster.local:8080/api/v1"
+
+          - name: ENABLE_ANALYTICS
+            value:
+              _default: "1"
+
+          - name: FLOWS_DB_HOST
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: FLOWS_DB_PORT
+            value:
+              _default: "5432"
+
+          - name: ISSUES_DB_PORT
+            value:
+              _default: "5432"
+
+          - name: ISSUES_DB_HOST
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: ENABLE_CELERY
+            value:
+              _default: "1"
+
+          - name: ENABLE_MAILGUN
+            value:
+              _default: "0"
+
+          - name: ENABLE_METRICS
+            value:
+              _default: "0"
+
+          - name: FROM_EMAIL
+            value:
+              _default: "wb@wb.ru"
+
+          - name: GATEWAY_URL
+            value:
+              _default: "http://pdm-api.documentations.svc.cluster.local:8080"
+
+          - name: PG_HOST
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: PG_PORT
+            value:
+              _default: "5432"
+
+          - name: RABBITMQ_HOST
+            value:
+              _default: "rabbitmq.rabbitmq.svc.cluster.local"
+
+          - name: RABBITMQ_PORT
+            value:
+              _default: "5672"
+
+          - name: DJANGO_BASE_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: RESOURCE_URL
+            value:
+              _default: "http://resources-service.resources.svc.cluster.local:8000"
+
+          - name: SERVICE_HOST
+            value:
+              _default: "https://lk.srx.wb.ru:30443/flows/api/v1"
+
+          - name: SMTP_HOST
+            value:
+              _default: "smtp-relay.wb.com"
+
+          - name: SMTP_PORT
+            value:
+              _default: "587"
+
+          - name: SYNC_RESOURCE_ID
+            value:
+              _default: "1"
+
+          - name: TIMEOUT
+            value:
+              _default: "120"
+
+          - name: WORKFLOWS_HOST
+            value:
+              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000/api/v1"
+
+          - name: WORKFLOWS_TIMEOUT
+            value:
+              _default: "60"
+
+          - name: DOCUMENTATION_TIMEOUT
+            value:
+              _default: "60"
+
+        secretEnvs:
+          - name: ADMIN_PANEL_SECRET_KEY
+            secretName:
+              _default: "admin-secret"
+            secretKey: "key"
+
+          - name: JWT_PUBLIC_KEY
+            secretName:
+              _default: "jwt-secret"
+            secretKey: "public_key"
+
+          - name: DOCUMENTATION_PG_USERNAME
+            secretName:
+              _default: "postgres-secret-documentations"
+            secretKey: "username"
+
+          - name: DOCUMENTATION_PG_PASSWORD
+            secretName:
+              _default: "postgres-secret-documentations"
+            secretKey: "password"
+
+          - name: FLOWS_DB_DB
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "database"
+
+          - name: FLOWS_DB_USERNAME
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: FLOWS_DB_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: ISSUES_DB_DB
+            secretName:
+              _default: "postgres-secret-issues"
+            secretKey: "database"
+
+          - name: ISSUES_DB_USERNAME
+            secretName:
+              _default: "postgres-secret-issues"
+            secretKey: "username"
+
+          - name: ISSUES_DB_PASSWORD
+            secretName:
+              _default: "postgres-secret-issues"
+            secretKey: "password"
+
+          - name: DJANGO_AUTH
+            secretName:
+              _default: "django-secret"
+            secretKey: "token"
+
+          - name: DJANGO_TOKEN
+            secretName:
+              _default: "django-secret"
+            secretKey: "token"
+
+          - name: PG_DB
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "database"
+
+          - name: PG_LOGIN
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: PG_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: RABBITMQ_USERNAME
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "username"
+
+          - name: RABBITMQ_PASSWORD
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "password"
+
+          - name: RABBITMQ_VHOST
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "vhost"
+
+          - name: KAFKA_USERNAME
+            secretName:
+              _default: "kafka-secret"
+            secretKey: "username"
+
+          - name: KAFKA_PASSWORD
+            secretName:
+              _default: "kafka-secret"
+            secretKey: "password"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/flows/wb/frontend.yaml

@@ -0,0 +1,95 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: flows
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      frontend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_5b2bd144
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: frontend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          resources:
+            requests:
+              cpu:
+                _default: 100m
+              memory:
+                _default: 100Mi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: frontend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/flows/wb/kafka-configmap.yaml

@@ -0,0 +1,67 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kafka-configmap
+  namespace: flows
+data:
+  kafka.py: |
+    import ssl
+    from functools import partial
+
+    import anyio
+    from faststream.kafka import KafkaBroker
+    from faststream.security import BaseSecurity
+
+    from flow.config import logger, settings
+    from flow.models.events import BaseEvent
+
+
+    def _build_broker() -> KafkaBroker:
+        ssl_context = ssl.create_default_context()
+
+        ssl_context.check_hostname = False
+        ssl_context.verify_mode = ssl.CERT_NONE
+
+        if settings.kafka.ssl_cert:
+            ssl_context.load_verify_locations(cadata=settings.kafka.ssl_cert)
+
+        security = BaseSecurity(
+            ssl_context=ssl_context,
+            use_ssl=True,
+        )
+
+        return KafkaBroker(
+            bootstrap_servers=[settings.kafka.host],
+            security=security,
+        )
+
+
+    broker = _build_broker()
+
+
+    async def _publish(event: BaseEvent, key: str) -> None:
+        await broker.publish(
+            message=event,
+            topic=event.metadata.event_type,
+            key=key.encode(),
+        )
+
+
+    def publish_event(event: BaseEvent, key: str) -> None:
+        if not settings.enable_events:
+            return
+
+        try:
+            anyio.from_thread.run(partial(_publish, event, key))
+        except Exception:
+            logger.exception(
+                "Failed to publish kafka event %s",
+                event.metadata.event_type,
+            )
+
+
+    __all__ = [
+        "broker",
+        "publish_event",
+    ]

apps/flows/wb/kustomization.yaml

@@ -0,0 +1,10 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: flows
+resources:
+  - authentication-configmap.yaml
+  - kafka-configmap.yaml
+  - backend.yaml
+  - celery.yaml
+  - frontend.yaml

apps/iam/wb/backend-s3.yaml

@@ -0,0 +1,87 @@
+---
+# В base S3_ENDPOINT_URL смотрит на storage.yandexcloud.net (Яндекс.Облако) —
+# в wb используется собственный self-hosted MinIO.
+# ZITADEL_HOST в base (sarex-login.uralmine.com) не трогаем: это общий
+# платформенный SSO для iam, не переопределяется ни в одном клиентском контуре.
+#
+# TODO: для iam в vault wb (1.yaml) ещё не заведён infrastructure.minio.apps.iam
+# (нет реального client.endpoint/bucket, в отличие от attachments/django/...) —
+# 10.49.10.90:9000 здесь взят по аналогии с остальными приложениями wb.
+# Проверить/поправить, когда в vault появится бакет для iam.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: iam-backend
+  namespace: iam
+spec:
+  values:
+    services:
+      backend:
+        envs:
+          - name: ENVIRONMENT
+            value:
+              _default: "prod"
+
+          - name: LOG_LEVEL
+            value:
+              _default: "debug"
+
+          - name: AUTH_ENABLED
+            value:
+              _default: "true"
+
+          - name: HTTP_PORT
+            value:
+              _default: "8080"
+
+          - name: HTTP_READ_BUFFER_SIZE
+            value:
+              _default: "131072"
+
+          - name: DB_MIGRATIONS_PATH
+            value:
+              _default: "migrations"
+
+          - name: ZITADEL_ENABLED
+            value:
+              _default: "true"
+
+          - name: ZITADEL_HOST
+            value:
+              _default: "https://sarex-login.uralmine.com"
+
+          - name: ZITADEL_ORG_RULES_FILE
+            value:
+              _default: "config/zitadel/org-rules-prod.json"
+
+          - name: S3_ENABLED
+            value:
+              _default: "true"
+
+          - name: S3_ENDPOINT_URL
+            value:
+              _default: "http://10.49.10.90:9000"
+
+          - name: S3_BUCKET_NAME
+            value:
+              _default: "sarex-media-storage"
+
+          - name: S3_REGION
+            value:
+              _default: "ru-central1"
+
+          - name: S3_PRESIGN_EXPIRES
+            value:
+              _default: "1h"
+
+          - name: KAFKA_ENABLED
+            value:
+              _default: "false"
+
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: "/etc/ca-certificates/Yandex/ca-cert"
+
+          - name: KAFKA_TOPIC_LEGACY_AMS_SYNC
+            value:
+              _default: "ams-sync"

apps/iam/wb/kustomization.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: iam
+resources:
+  - ../base
+patches:
+  - path: backend-s3.yaml
+    target:
+      kind: HelmRelease
+      name: iam-backend

apps/inspections/wb/backend.yaml

@@ -0,0 +1,234 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: inspections-backend
+  namespace: inspections
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      api:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:production_1a33f6f4
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: inspections-backend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: sarex-inspections-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        envs:
+          - name: DEBUG
+            value:
+              _default: "false"
+
+          - name: SERVICE_URL
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: HTTP_APP_HOST
+            value:
+              _default: "0.0.0.0"
+
+          - name: HTTP_APP_PORT
+            value:
+              _default: "8000"
+
+          - name: HTTP_APP_ROOT_PATH
+            value:
+              _default: "/inspections"
+
+          - name: HTTP_APP_WORKERS
+            value:
+              _default: "3"
+
+          - name: HTTP_APP_ADMIN_ENABLE
+            value:
+              _default: "true"
+
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: "/usr/local/share/ca-certificates/Yandex/YandexInternalRootCA.crt"
+
+          - name: KAFKA_EAV_ASSETS_TOPIC
+            value:
+              _default: "assets_broadcast"
+
+          - name: JWT_AUTH_ENABLE
+            value:
+              _default: "true"
+
+          - name: NOTIFICATIONS_ENABLE
+            value:
+              _default: "true"
+
+          - name: NOTIFICATIONS_EMAIL_FROM
+            value:
+              _default: "hello@sarex.io"
+
+          - name: SAREX_BACKEND_URL
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: SAREX_BACKEND_TIMEOUT
+            value:
+              _default: "30"
+
+          - name: EAV_URL
+            value:
+              _default: "http://eav-service.eav"
+
+          - name: EAV_TIMEOUT
+            value:
+              _default: "30"
+
+          # В дампе кластера значение было http://workflows-service.processing-prod —
+          # тот же неймспейс, что в вопросе про processing/workflow: реальный
+          # ns у processing в wb — workflow.
+          - name: WORKFLOWS_URL
+            value:
+              _default: "http://workflows-service.workflow"
+
+          - name: WORKFLOWS_TIMEOUT
+            value:
+              _default: "30"
+
+          - name: WORKFLOWS_EMAIL_DOCKER_IMAGE
+            value:
+              _default: "cr.yandex/crp3ccidau046kdj8g9q/notification:email"
+
+          - name: MOBILE_APP_CURRENT_VERSION
+            value:
+              _default: "1.0.0"
+
+          - name: MOBILE_APP_RECOMMENDED_VERSION
+            value:
+              _default: "1.0.0"
+
+          - name: MOBILE_APP_REQUIRED_VERSION
+            value:
+              _default: "1.0.0"
+
+          - name: MAILER_URL
+            value:
+              _default: "http://mailer-service.mailer:8000"
+
+          - name: MAILER_TIMEOUT
+            value:
+              _default: "30"
+
+        secretEnvs:
+          - name: DATABASE_USER
+            secretName:
+              _default: "pg-secret"
+            secretKey: "username"
+
+          - name: DATABASE_PORT
+            secretName:
+              _default: "pg-secret"
+            secretKey: "port"
+
+          - name: DATABASE_NAME
+            secretName:
+              _default: "pg-secret"
+            secretKey: "database"
+
+          - name: DATABASE_HOST
+            secretName:
+              _default: "pg-secret"
+            secretKey: "host"
+
+          - name: DATABASE_PASSWORD
+            secretName:
+              _default: "pg-secret"
+            secretKey: "password"
+
+          - name: KAFKA_HOST
+            secretName:
+              _default: "kafka-secret"
+            secretKey: "host"
+
+          - name: KAFKA_USERNAME
+            secretName:
+              _default: "kafka-secret"
+            secretKey: "username"
+
+          - name: KAFKA_PASSWORD
+            secretName:
+              _default: "kafka-secret"
+            secretKey: "password"
+
+          - name: SAREX_BACKEND_AUTH
+            secretName:
+              _default: "sarex-backend-auth-secret"
+            secretKey: "key"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/inspections/wb/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: inspections
+resources:
+  - backend.yaml

apps/issues/base/backend.yaml

@@ -42,7 +42,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_2dc38909
+            _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_bbb9d29a
           pullPolicy:
             _default: IfNotPresent
 

apps/issues/base/celery.yaml

@@ -42,7 +42,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_2dc38909
+            _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_bbb9d29a
           pullPolicy:
             _default: IfNotPresent
 

apps/issues/base/frontend.yaml

@@ -36,7 +36,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/contour_issues-frontend:716a2b73
+            _default: cr.yandex/crp3ccidau046kdj8g9q/contour_issues-frontend:b56b9da1
           pullPolicy:
             _default: IfNotPresent
 

apps/issues/brusnika-stage/backend.yaml

@@ -176,10 +176,6 @@ spec:
           - name: API_ADDRESS
             value:
               _default: "8000"
-
-          - name: RABBITMQ_HOSTNAME
-            value:
-              _default: "rabbitmq-service:5672"
         secretEnvs:
           - name: YC_S3_ACCESS_KEY_ID
             secretName:
@@ -231,19 +227,24 @@ spec:
               _default: "postgres-secret"
             secretKey: "database"
 
+          - name: RABBITMQ_HOSTNAME
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "hostname"
+
           - name: RABBITMQ_VHOST
             secretName:
-              _default: "rabbitmq-secret"
+              _default: "rabbitmq"
             secretKey: "vhost"
 
           - name: RABBITMQ_USERNAME
             secretName:
-              _default: "rabbitmq-secret"
+              _default: "rabbitmq"
             secretKey: "username"
 
           - name: RABBITMQ_PASSWORD
             secretName:
-              _default: "rabbitmq-secret"
+              _default: "rabbitmq"
             secretKey: "password"
 
           - name: JWT_PRIVATE_KEY

apps/issues/brusnika-stage/celery.yaml

@@ -187,10 +187,6 @@ spec:
           - name: API_ADDRESS
             value:
               _default: "8000"
-
-          - name: RABBITMQ_HOSTNAME
-            value:
-              _default: "rabbitmq-service:5672"
         secretEnvs:
           - name: YC_S3_ACCESS_KEY_ID
             secretName:
@@ -242,19 +238,24 @@ spec:
               _default: "postgres-secret"
             secretKey: "database"
 
+          - name: RABBITMQ_HOSTNAME
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "hostname"
+
           - name: RABBITMQ_VHOST
             secretName:
-              _default: "rabbitmq-secret"
+              _default: "rabbitmq"
             secretKey: "vhost"
 
           - name: RABBITMQ_USERNAME
             secretName:
-              _default: "rabbitmq-secret"
+              _default: "rabbitmq"
             secretKey: "username"
 
           - name: RABBITMQ_PASSWORD
             secretName:
-              _default: "rabbitmq-secret"
+              _default: "rabbitmq"
             secretKey: "password"
 
           - name: JWT_PRIVATE_KEY

apps/issues/wb/app-configmap.yaml

@@ -0,0 +1,55 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: app
+  namespace: issues
+data:
+  app.py: |
+    import ssl
+    from django.conf import settings
+    from faststream import FastStream
+    from faststream.kafka import KafkaBroker
+    from faststream.security import BaseSecurity
+
+
+    def get_broker() -> KafkaBroker:
+        ssl_context = ssl.create_default_context(
+            cafile=settings.KAFKA_SSL_CAFILE,
+        )
+
+        # Сертификат передаем, но hostname не проверяем
+        ssl_context.check_hostname = False
+
+        # Для самоподписанного сертификата
+        ssl_context.verify_mode = ssl.CERT_NONE
+
+        security = BaseSecurity(
+            ssl_context=ssl_context,
+            use_ssl=True,
+        )
+
+        broker = KafkaBroker(
+            bootstrap_servers=[settings.KAFKA_HOST],
+            security=security,
+        )
+
+        return broker
+
+
+    def get_consumer_broker() -> KafkaBroker:
+        broker = get_broker()
+
+        from kafka_app.consumers import eav_router
+
+        broker.include_router(eav_router)
+
+        return broker
+
+
+    def configure_app() -> FastStream:
+        broker = get_consumer_broker()
+
+        app = FastStream(broker)
+
+        return app

apps/issues/wb/celery.yaml

@@ -0,0 +1,281 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: celery
+  namespace: issues
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      celery:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_bbb9d29a
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: celery
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          command:
+            _default: ["celery", "-A", "config", "worker", "-l", "info", "-E"]
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: false
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: kafka-cert-volume
+              mountPath:
+                _default: /usr/local/share/ca-certificates
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: kafka-cert
+
+            - name: app
+              mountPath:
+                _default: /src/kafka_app/app.py
+              subPath:
+                _default: app.py
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: app
+                items:
+                  - key: app.py
+                    path:
+                      _default: app.py
+
+            - name: uwsgi-configmap
+              mountPath:
+                _default: /opt/server/uwsgi.ini
+              subPath:
+                _default: uwsgi.ini
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: uwsgi-configmap
+                items:
+                  - key: uwsgi.ini
+                    path:
+                      _default: uwsgi.ini
+
+            - name: production-configmap
+              mountPath:
+                _default: /src/config/settings/production.py
+              subPath:
+                _default: production.py
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: production-configmap
+                items:
+                  - key: production.py
+                    path:
+                      _default: production.py
+
+        envs:
+          - name: ENVIRONMENT
+            value:
+              _default: "production"
+
+          - name: AERO_PUBLIC_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: AERO_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: BASE_AERO_URL
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: BASE_AUTH_URL
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: WORKFLOWS_HOST
+            value:
+              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000"
+
+          - name: WORKFLOWS_URL
+            value:
+              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000"
+
+          - name: RESOURCES_API_HOST
+            value:
+              _default: "http://resources-service.resources.svc.cluster.local:8000"
+
+          - name: EAV_HOST
+            value:
+              _default: "http://eav-service.eav.svc.cluster.local:8000"
+
+          - name: USE_NOTIFICATIONS
+            value:
+              _default: "True"
+
+          - name: ENABLE_MAILGUN
+            value:
+              _default: "False"
+
+          - name: SAREX_API
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: DOCUMENTATIONS_URL
+            value:
+              _default: "http://documentations-api.documentations.svc.cluster.local:8080"
+
+          - name: DJANGO_SETTINGS_MODULE
+            value:
+              _default: "config.settings.production"
+
+          - name: DATABASE_HOST
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: DATABASE_PORT
+            value:
+              _default: "5432"
+
+          - name: API_ADDRESS
+            value:
+              _default: "8000"
+
+          - name: RABBITMQ_HOSTNAME
+            value:
+              _default: "rabbitmq.rabbitmq.svc.cluster.local:5672"
+
+        secretEnvs:
+          - name: YC_S3_ACCESS_KEY_ID
+            secretName:
+              _default: "yc-s3-secret"
+            secretKey: "key_id"
+
+          - name: YC_S3_SECRET_ACCESS_KEY
+            secretName:
+              _default: "yc-s3-secret"
+            secretKey: "access_key"
+
+          - name: YC_S3_BUCKET_NAME
+            secretName:
+              _default: "yc-s3-secret"
+            secretKey: "storage_bucket_name"
+
+          - name: YC_S3_ENDPOINT_URL
+            secretName:
+              _default: "yc-s3-secret"
+            secretKey: "endpoint_url"
+
+          - name: DJANGO_BASIC_AUTH
+            secretName:
+              _default: "django-auth"
+            secretKey: "key"
+
+          - name: SAREX_USERNAME
+            secretName:
+              _default: "sarex-auth"
+            secretKey: "username"
+
+          - name: SAREX_PASSWORD
+            secretName:
+              _default: "sarex-auth"
+            secretKey: "password"
+
+          - name: DATABASE_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: DATABASE_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: DATABASE_NAME
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "database"
+
+          - name: RABBITMQ_VHOST
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "vhost"
+
+          - name: RABBITMQ_USERNAME
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "username"
+
+          - name: RABBITMQ_PASSWORD
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "password"
+
+          - name: JWT_PRIVATE_KEY
+            secretName:
+              _default: "backend-secret"
+            secretKey: "ssh_private.key"
+
+          - name: JWT_PUBLIC_KEY
+            secretName:
+              _default: "backend-secret"
+            secretKey: "ssh_public.key"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/issues/wb/issues.yaml

@@ -0,0 +1,270 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: issues
+  namespace: issues
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      issues:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_bbb9d29a
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: issues
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: issues-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: kafka-cert-volume
+              mountPath:
+                _default: /usr/local/share/ca-certificates
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: kafka-cert
+
+            - name: uwsgi-configmap
+              mountPath:
+                _default: /opt/server/uwsgi.ini
+              subPath:
+                _default: uwsgi.ini
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: uwsgi-configmap
+                items:
+                  - key: uwsgi.ini
+                    path:
+                      _default: uwsgi.ini
+
+            - name: production-configmap
+              mountPath:
+                _default: /src/config/settings/production.py
+              subPath:
+                _default: production.py
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: production-configmap
+                items:
+                  - key: production.py
+                    path:
+                      _default: production.py
+
+        envs:
+          - name: ENVIRONMENT
+            value:
+              _default: "production"
+
+          - name: AERO_PUBLIC_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: AERO_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: BASE_AERO_URL
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: BASE_AUTH_URL
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+          - name: WORKFLOWS_HOST
+            value:
+              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000"
+
+          - name: WORKFLOWS_URL
+            value:
+              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000"
+
+          - name: RESOURCES_API_HOST
+            value:
+              _default: "http://resources-service.resources.svc.cluster.local:8000"
+
+          - name: EAV_HOST
+            value:
+              _default: "http://eav-service.eav.svc.cluster.local:8000"
+
+          - name: SAREX_API
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: DOCUMENTATIONS_URL
+            value:
+              _default: "http://documentations-api.documentations.svc.cluster.local:8080"
+
+          - name: DJANGO_SETTINGS_MODULE
+            value:
+              _default: "config.settings.production"
+
+          - name: DATABASE_HOST
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: DATABASE_PORT
+            value:
+              _default: "5432"
+
+          - name: API_ADDRESS
+            value:
+              _default: "8000"
+
+          - name: RABBITMQ_HOSTNAME
+            value:
+              _default: "rabbitmq.rabbitmq.svc.cluster.local:5672"
+
+        secretEnvs:
+          - name: YC_S3_ACCESS_KEY_ID
+            secretName:
+              _default: "yc-s3-secret"
+            secretKey: "key_id"
+
+          - name: YC_S3_SECRET_ACCESS_KEY
+            secretName:
+              _default: "yc-s3-secret"
+            secretKey: "access_key"
+
+          - name: YC_S3_BUCKET_NAME
+            secretName:
+              _default: "yc-s3-secret"
+            secretKey: "storage_bucket_name"
+
+          - name: YC_S3_ENDPOINT_URL
+            secretName:
+              _default: "yc-s3-secret"
+            secretKey: "endpoint_url"
+
+          - name: DJANGO_BASIC_AUTH
+            secretName:
+              _default: "django-auth"
+            secretKey: "key"
+
+          - name: SAREX_USERNAME
+            secretName:
+              _default: "sarex-auth"
+            secretKey: "username"
+
+          - name: SAREX_PASSWORD
+            secretName:
+              _default: "sarex-auth"
+            secretKey: "password"
+
+          - name: DATABASE_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: DATABASE_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: DATABASE_NAME
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "database"
+
+          - name: RABBITMQ_VHOST
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "vhost"
+
+          - name: RABBITMQ_USERNAME
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "username"
+
+          - name: RABBITMQ_PASSWORD
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "password"
+
+          - name: JWT_PRIVATE_KEY
+            secretName:
+              _default: "backend-secret"
+            secretKey: "ssh_private.key"
+
+          - name: JWT_PUBLIC_KEY
+            secretName:
+              _default: "backend-secret"
+            secretKey: "ssh_public.key"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/issues/wb/kafka-cert-configmap.yaml

@@ -0,0 +1,38 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kafka-cert
+  namespace: issues
+data:
+  kafka.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIIFLTCCAxWgAwIBAgIUA5L48eHPMqNFYE5wIgaOmWgG3okwDQYJKoZIhvcNAQEN
+    BQAwLTETMBEGA1UECgwKaW8uc3RyaW16aTEWMBQGA1UEAwwNY2x1c3Rlci1jYSB2
+    MDAeFw0yNTA2MDQxMTMzMTRaFw0yNjA2MDQxMTMzMTRaMC0xEzARBgNVBAoMCmlv
+    LnN0cmltemkxFjAUBgNVBAMMDWNsdXN0ZXItY2EgdjAwggIiMA0GCSqGSIb3DQEB
+    AQUAA4ICDwAwggIKAoICAQDV2NBVwnXISH9i8K4KxSd2AThwgQyRKyeIfcqeYZ4F
+    7FguEUI7uEtoWd4uO8DsIzoMoLYv5L1DfhNYUFWN3XYQd4XVFnwYQYbwspdC1L8G
+    u0T7943gRRRomcNP8n5nycfeZgZgmz9IS8vmxgRh4ao0kcCW49uBQMd706087UAI
+    qaRJTcabTZq1LTeoH9AOAyT/nawKm+1H5VmrMUBjzz9xKVXF0sCrhjYoZoM4x+fY
+    AphtxZDB21ZhEcHBbytEQkEm0QTbUP4xbu95yqY6goYi9S9R1uMgVZ9DoJVwyqLm
+    /3ZGPjd9VmdBPO/zE/Bj890DjyKS7AXo9d+Iyv4M2QD1jA+5j4JyHzk7Lroz+HTg
+    mwVpcVGafBWIC4qFt7C3UYt6IV64/MA2v9gxTIdJvOBZxKUiMl7f65jKNEntF6is
+    86QCkjhvt34AThEoGx8SPjVr3sOBuneqcybeSYLyEWFg9Z1mWfMLHlA/Fp/Y2wpM
+    w1ZXj6uAa/UNUAIfkaLTOKHHaCCVD2G3Vkm94NHOJmDj6ze8P0J0H+Ub6ULD7hHr
+    8obOSk9OvxoxVzE+UW7DyEL6YD8MBVUQKJIQVgZmpT4akWyz8bNhFRzgTnKAhwNN
+    ATrGmjfX/wj7tCpy/PoJjEiu54sXW5xplBIz/ZgYHrPkyrbhQxsRozgQ+UIMIIbJ
+    /wIDAQABo0UwQzAdBgNVHQ4EFgQUkU4HKndgWxhcXMAe5XBc4OJwSgcwEgYDVR0T
+    AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQENBQADggIB
+    AFLi5QLawZollou3+m5kYcBe5F8xKG5NlgNmKyIREnwD2AP4xrr2tNFbmP2hpEl4
+    bWJJ84IHlKjpYxFLboWzgtW/JvdxcEh0K/x8/7cOD3Kk9d/LR9muj57mFYSQGlbo
+    g0+lHNuLam8xGcnGVV5VdfcjFz72/q92ndTlJmz+v6OneTJvIypKoBmNKF25alz9
+    pR2sTwoG0Pcwm30u/uS6pOewQ4sTiniOcc1MFYF7tl/Zz9Mqza8Rer0B5nm8lE/J
+    Yo9UaEXyVLM8Y5kSOkxMlOK+8/UMeY/lcQYpd5tYVpvarnoPCjmUjt4iVw26ZsAH
+    y4/vNW+wX+Uauarik1jHL/SauAjS3FbJoH06BBnji7J/Rud2DtSd+vVZrIBLJkaH
+    +Xg/roD3xKx0XmhLJmPvxGrkyehbhkbJkPKCHa9P56rnev3MYjyy+SV7Vp8Dq+HF
+    Wkswl3QUPWx9reuvF2KMyt04Tw94UAxCUGkX5qg7Dq5d0Fj/AcIrFdLTCV8eG/UI
+    1kKRxmZ2/ALINBOlfJOVVovKBlWpPACs8iy6XreOXtoQfzoG2F9Vo3Jmzjpqsmz0
+    9Ao4s2vcz3UuDtBhpwGp4N3zroyst/kQjtZirj4cS7fu75tB5N5mQ/tTwg0Tiw+Y
+    XIdxeE73V5DAf4Dd5V1VdCbA6oQv5qJYvinYydyx4x3V
+    -----END CERTIFICATE-----

apps/issues/wb/kustomization.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: issues
+resources:
+  - app-configmap.yaml
+  - production-configmap.yaml
+  - uwsgi-configmap.yaml
+  - kafka-cert-configmap.yaml
+  - issues.yaml
+  - celery.yaml
+  - redis.yaml
+  - static.yaml
+  - remarks-static.yaml

apps/issues/wb/production-configmap.yaml

@@ -0,0 +1,143 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: production-configmap
+  namespace: issues
+data:
+  production.py: |
+    from datetime import timedelta
+    import os
+    from .base import *
+
+    # DEBUG SETTINGS START
+    # -----------------------------------------------------------------------------
+    DEBUG = True
+    # -----------------------------------------------------------------------------
+
+    TEST_MODE = False
+    #USE_NOTIFICATIONS = False
+    AWS_S3_VERIFY=False
+
+    # SECRETS SETTINGS START
+    # -----------------------------------------------------------------------------
+    SECRET_KEY = "FromToMuchLoveOfLiving"  # Delete after Test
+    # -----------------------------------------------------------------------------
+
+    DJANGO_TOKEN="aGFnZW4wMTM6emVhbG90MDk2"
+
+    # ALLOWED HOSTS START
+    # -----------------------------------------------------------------------------
+    ALLOWED_HOSTS = ["*"]
+    # -----------------------------------------------------------------------------
+
+    # APPS SETTINGS START
+    # -----------------------------------------------------------------------------
+    # INSTALLED_APPS += [
+    #     "django_extensions",
+    # ]
+    # -----------------------------------------------------------------------------
+
+    # DEBUG SETTINGS START
+    # -----------------------------------------------------------------------------
+    DEBUG = True
+    # -----------------------------------------------------------------------------
+
+    REVIEW_HOST='http://backend-service.flows.svc.cluster.local:8000'
+    # -----------------------------------------------------------------------------
+    # EXTERNAL SERVICES END
+
+    WORKFLOWS_HOST = "http://workflows-api-service.workflow.svc.cluster.local:8000"
+    WORKFLOWS_URL = "http://workflows-api-service.workflow.svc.cluster.local:8000"
+    DOCUMENTATIONS_URL = "http://documentations-api.documentations.svc.cluster.local:8080"
+    RESOURCES_API_HOST = os.getenv("RESOURCES_API_HOST", default="http://resources-service.resources.svc.cluster:8000")
+    KAFKA_HOST = "wb-prod-kafka-bootstrap.kafka.svc.cluster.local:9093"
+    KAFKA_USERNAME = "sarex"
+    KAFKA_PASSWORD = "nK36sasvSfoItJnXQ4qxav2OUWIPX5ZC"
+    KAFKA_SSL_CAFILE = os.getenv("KAFKA_SSL_CAFILE", "/usr/local/share/ca-certificates/kafka.crt")
+    KAFKA_EAV_ASSETS_TOPIC = os.getenv("KAFKA_EAV_ASSETS_TOPIC", "sarex")
+    KAFKA_ISSUES_TOPIC = os.getenv("KAFKA_ISSUES_TOPIC", "sarex-issues")
+
+
+    USE_ASYNC_FUNCTIONS = True
+    #USE_NOTIFICATIONS = False
+
+    # JWT SETTINGS START
+    # ---------------------------------------------------------------------------------------------------------------------
+    SIMPLE_JWT_ISSUER = os.getenv("SIMPLE_JWT_ISSUER", default="default_issuer")
+
+    SIMPLE_JWT = {
+        "ACCESS_TOKEN_LIFETIME": timedelta(minutes=5),
+        "REFRESH_TOKEN_LIFETIME": timedelta(days=1),
+        "ROTATE_REFRESH_TOKENS": False,
+        "UPDATE_LAST_LOGIN": False,
+
+        "ALGORITHM": "RS512",
+        "SIGNING_KEY": os.getenv("JWT_PRIVATE_KEY", default="").replace("\\n", "\n"),
+        "VERIFYING_KEY": os.getenv("JWT_PUBLIC_KEY").replace("\\n", "\n"),
+        "AUDIENCE": None,
+        "ISSUER": SIMPLE_JWT_ISSUER,
+
+        "AUTH_HEADER_TYPES": ("Bearer",),
+        "AUTH_HEADER_NAME": "HTTP_AUTHORIZATION",
+        "USER_ID_FIELD": "id",
+        "USER_ID_CLAIM": "user_id",
+
+        "AUTH_TOKEN_CLASSES": ("rest_framework_simplejwt.tokens.AccessToken",),
+        "TOKEN_TYPE_CLAIM": "token_type",
+
+        "JTI_CLAIM": "jti",
+
+        "SLIDING_TOKEN_REFRESH_EXP_CLAIM": "refresh_exp",
+        "SLIDING_TOKEN_LIFETIME": timedelta(minutes=5),
+        "SLIDING_TOKEN_REFRESH_LIFETIME": timedelta(days=1),
+    }
+    # ---------------------------------------------------------------------------------------------------------------------
+
+    CORS_ALLOWED_ORIGINS = [
+        "https://lk.srx.wb.ru:30443",
+    ]
+
+    CORS_TRUSTED_ORIGINS = [
+        "https://lk.srx.wb.ru:30443",
+    ]
+
+    CSRF_TRUSTED_ORIGINS = [
+        "https://lk.srx.wb.ru:30443",
+    ]
+
+    CORS_ALLOW_ALL_ORIGINS = True
+    ENABLE_MAILGUN=False
+    SMTP_PORT=465
+    SMTP_HOST="mail.rwb.ru"
+    EMAIL_FROM="sarex@rwb.ru"
+
+    CORS_ALLOW_METHODS = [
+        "DELETE",
+        "GET",
+        "OPTIONS",
+        "PATCH",
+        "POST",
+        "PUT",
+    ]
+
+    SAREX_API = "https://srx.wb.ru"
+
+    AERO_PUBLIC_HOST = os.getenv("AERO_PUBLIC_HOST", default=SAREX_API)
+
+    BASE_AERO_URL = "http://backend.django.svc.cluster.local:8000"
+
+    ENVIRONMENT = "production"
+
+    SESSION_COOKIE_NAME = "issues-sessionid"
+    CSRF_COOKIE_NAME = "issues-csrftoken"
+    STATIC_URL = "/static/"
+    STORAGES = {
+        'default': {
+            'BACKEND': "storages.backends.s3boto3.S3Boto3Storage",
+        },
+        'staticfiles': {
+            # Leave whatever setting you already have here, e.g.:
+            'BACKEND': "storages.backends.s3boto3.S3Boto3Storage",
+        }
+    }

apps/issues/wb/redis.yaml

@@ -0,0 +1,88 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: redis
+  namespace: issues
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      redis:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/redis:latest
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: redis
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 6379
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: redis
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 6379
+
+          targetPort:
+            _default: 6379
+
+          portName:
+            _default: tcp
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/issues/wb/remarks-static.yaml

@@ -0,0 +1,90 @@
+---
+# remarks-static — компонент приложения remarks (apps/remarks), в wb
+# развёрнут в ns issues, а не в своём собственном неймспейсе.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: remarks-static
+  namespace: issues
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      remarks-static:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/remarks-frontend:wb_2c0adf31
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: remarks-static
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8080
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: remarks-static
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 8080
+
+          portName:
+            _default: tcp
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/issues/wb/static.yaml

@@ -0,0 +1,88 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: static
+  namespace: issues
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      static:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/contour_issues-frontend:b56b9da1
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: static
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: static-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/issues/wb/uwsgi-configmap.yaml

@@ -0,0 +1,23 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: uwsgi-configmap
+  namespace: issues
+data:
+  uwsgi.ini: |-
+    [uwsgi]
+    plugins-dir = /usr/lib/uwsgi/plugins
+
+    chdir           = /src
+    module          = config.wsgi:application
+    master          = true
+    processes       = 4
+    http            = 0.0.0.0:8000
+    chmod-socket    = 666
+    vacuum          = true
+    harakiri        = 6000
+    buffer-size     = 32768
+
+    static-map = /static=/opt/src/static/
+    static-map = /media=/opt/src/media/

apps/message-hub/wb/kafka-cert-configmap.yaml

@@ -0,0 +1,38 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kafka-cert
+  namespace: message-hub
+data:
+  kafka.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIIFLTCCAxWgAwIBAgIUYDZPxGRsr7IiqHEmfd07QTQlOKYwDQYJKoZIhvcNAQEN
+    BQAwLTETMBEGA1UECgwKaW8uc3RyaW16aTEWMBQGA1UEAwwNY2x1c3Rlci1jYSB2
+    MDAeFw0yNTEyMTYxNDM0NTVaFw0yNjEyMTYxNDM0NTVaMC0xEzARBgNVBAoMCmlv
+    LnN0cmltemkxFjAUBgNVBAMMDWNsdXN0ZXItY2EgdjAwggIiMA0GCSqGSIb3DQEB
+    AQUAA4ICDwAwggIKAoICAQCfzDZhEzw2pbU5Xpu8OzD+3iQG+DVjU8PQWWQEF27h
+    yjohDkUr3zCZtW7xMKWKUNxBgrKsfe4TDOQN8cij3cS9sy0So+UhMeF7Bq9PU1Yd
+    bmTRq8q1PiuNUkiCGJ5wrb3+NZvVxZLJUIFgiealsRw80MgMWWSzy0I35T2Edn/a
+    DU4jhlgQxyzQ621+oGP0n28gCjmm6pCq2tkj/Z8WTdu1gOWyRdK02a2uE2Ts2nLa
+    Di32GaZrIbIuD/WUd6Ek66uCeJvh2CT7s+SqgtMbtT7gibUuPQ3hk1VGQsjy22l3
+    hUNpLu86nrwbuf21mY55KnLOcaVq1ag1TpIIKfZAL/KWFCGZ6H6kwEIbCAL0Hei7
+    cJ2Wm2/qlzKUeU869M7YybZAfXl/t6XT4QgFgje+42N980vy5A4GhWi1Z7lPqqOe
+    jPGBstkRZybKz1sTk87+oJx82iQU/ozVmzjSEK1SoYRNbvug8PNpxmPoPnJ2flgG
+    t2q2+2ZQP3f1aAHVcZ3U5+hWlRmKPXzjrJv7gnhuvqJl7OwB50y+yWiVfZ9xrYl2
+    EpX+yHuFFK+9NnB5taUK8Fz+hQaLU8J4q7P0bRqkoI+LdcEErjuDT/eI2d5+Ql8K
+    /JkV823hX2WNB9bdaQ24BelVUbsxGpR7ms6KWrM11kHnbzUlEM+AxZES6F7Qbr55
+    TwIDAQABo0UwQzAdBgNVHQ4EFgQUM7hshx7e9TFEN82Pf446aBrJUA4wEgYDVR0T
+    AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQENBQADggIB
+    AFNHFGPDxY966fz0dxDFFSfeo47y7XQZMK9xAwH73cQoSeqx+IMxzgM8nfJQ9XMN
+    PeLwVRZ7pvRee2ZhUPglBSTHnW2rvfmLBOO9xyKZxRsCkoFxuHH9xfM7bFWb96R6
+    fGrOdEZDB3yj00T+tkubwqt+/dUhQUj8juwyPs55WMb/0BIbapaoQ6QOP13CaXDV
+    ZmAfsEEIBkNxfq7GTr/z0Rq0B4+9FxAf3Jrsmi/dYoFD/prHsvBDkYw1daoFyp5C
+    tbctvB9wtphnCCynekt8UBvpVKHUU/xaUa09TQTToXjBbV1SZeIOHNG0MNbWa4sz
+    AL/cpXdq1EAxiTeAVT9XhCwhe/xJvFZIWuFLmW3J+ZxrOUCKieCYpTqBY2tBkkDY
+    //egic787yTR6zxqQNSzvNU5LhzrN7lu+KHGM06T35+HvpzgPPiRCzsxO62p63op
+    mq04K31yYZgLiqeAj5W+rioRGJNn4TXJpH9KIrzmGM7lVWLYWMAKeZU4r1lDUdcu
+    7jsBH8BRJWJeVK3xVw2HB3lk7Xn0WrR92adeYQ3f0vKbMIAVUnSJ3yCKJ4NMFSki
+    j78nx2mi/G0RhUPGZ9hhLXQKj9BtbpEnwpbGWtf0ShtVOxD/HKLCr7koBtW9TMPS
+    9K0sJhE5VjsQLkDDu9p3GdRcuLNA/oa7xFvRFtqGFsLj
+    -----END CERTIFICATE-----

apps/message-hub/wb/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: message-hub
+resources:
+  - kafka-cert-configmap.yaml
+  - message-hub.yaml

apps/message-hub/wb/message-hub.yaml

@@ -0,0 +1,209 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: message-hub
+  namespace: message-hub
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      message-hub:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/message-hub:production_e8010fe4
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: message-hub-message-hub
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: message-hub-message-hub
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: kafka-cert-volume
+              mountPath:
+                _default: /usr/local/share/ca-certificates
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: kafka-cert
+
+        envs:
+          - name: WORKER_TIMEOUT
+            value:
+              _default: "60"
+
+          - name: PYTHONPATH
+            value:
+              _default: "src"
+
+          - name: SETTINGS_MAX_RETRIES
+            value:
+              _default: "1"
+
+          - name: SETTINGS_TOPICS
+            value:
+              _default: '{"planning": "pm", "assets": "assets_broadcast", "project_entity": "issues_broadcast"}'
+
+          - name: SETTINGS_PDF_CONVERTER_HOST
+            value:
+              _default: "http://export-project-service.django.svc.cluster.local:8000"
+
+          - name: SAREX_BASE_HOST
+            value:
+              _default: "http://backend-service.pm.svc.cluster.local:8000"
+
+          - name: DB_HOST
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: DB_PORT
+            value:
+              _default: "5432"
+
+          - name: DB_DATABASE
+            value:
+              _default: "pm_db"
+
+          - name: CACHE_HOST
+            value:
+              _default: "redis.pm.svc.cluster.local"
+
+          - name: CACHE_PORT
+            value:
+              _default: "6379"
+
+          - name: CACHE_SSL
+            value:
+              _default: "0"
+
+          - name: KAFKA_HOST
+            value:
+              _default: "wb-prod-kafka-bootstrap.kafka.svc.cluster.local"
+
+          - name: KAFKA_PORT
+            value:
+              _default: "9093"
+
+          - name: KAFKA_SECURITY_PROTOCOL
+            value:
+              _default: "SSL"
+
+          - name: KAFKA_SASL_MECHANISM
+            value:
+              _default: "SCRAM-SHA-512"
+
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: "/usr/local/share/ca-certificates/kafka.crt"
+
+        secretEnvs:
+          - name: KAFKA_USERNAME
+            secretName:
+              _default: "kafka-secret"
+            secretKey: "username"
+
+          - name: KAFKA_PASSWORD
+            secretName:
+              _default: "kafka-secret"
+            secretKey: "password"
+
+          - name: DB_USERNAME
+            secretName:
+              _default: "postgres-pm-secret"
+            secretKey: "username"
+
+          - name: DB_PASSWORD
+            secretName:
+              _default: "postgres-pm-secret"
+            secretKey: "password"
+
+          - name: S3_LOGIN
+            secretName:
+              _default: "s3-secret"
+            secretKey: "username"
+
+          - name: S3_PASSWORD
+            secretName:
+              _default: "s3-secret"
+            secretKey: "password"
+
+          - name: S3_BUCKET
+            secretName:
+              _default: "s3-secret"
+            secretKey: "bucket"
+
+          - name: S3_HOST
+            secretName:
+              _default: "s3-secret"
+            secretKey: "host"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/notes/wb/backend.yaml

@@ -0,0 +1,55 @@
+---
+# Патч backend для контура wb.
+#
+# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
+# поэтому здесь продублирован весь набор из apps/notes/base/backend.yaml.
+#
+# DJANGO_HOST/BASE_HOST/FAAS_SERVICE/WORKSPACE_URL/WORKFLOW_HOST/RESOURCE_URL
+# в base смотрят на домен sarex.io (lk.sarex.io, api.sarex.io/<service>) —
+# для wb это lk.srx.wb.ru:30443/<service>, по аналогии с rfi/transmittal.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: notes
+spec:
+  values:
+    services:
+      backend:
+        envs:
+          - name: PG_SSL_MODE
+            value:
+              _default: verify-full
+          - name: DJANGO_HOST
+            value:
+              _default: https://lk.srx.wb.ru:30443
+          - name: BASE_HOST
+            value:
+              _default: https://lk.srx.wb.ru:30443/notes
+          - name: TIMEOUT
+            value:
+              _default: "120"
+          - name: FAAS_SERVICE
+            value:
+              _default: https://lk.srx.wb.ru:30443/lambdas
+          - name: WORKSPACE_URL
+            value:
+              _default: https://lk.srx.wb.ru:30443/workspaces/api/v1
+          - name: WORKFLOW_HOST
+            value:
+              _default: https://lk.srx.wb.ru:30443/workflows/api/v1
+          - name: WORKFLOW_TAG
+            value:
+              _default: stable
+          - name: RESOURCE_URL
+            value:
+              _default: https://lk.srx.wb.ru:30443/resources/api/v1
+          - name: SYNC_RESOURCE_ID
+            value:
+              _default: "0"
+          - name: ENABLE_ND
+            value:
+              _default: "0"
+          - name: ATTACHMENT_HOST
+            value:
+              _default: http://attachments-service.attachments.svc.cluster.local:80/api/v1

apps/notes/wb/kustomization.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: notes
+resources:
+  - ../base
+patches:
+  - path: backend.yaml
+    target:
+      kind: HelmRelease
+      name: backend

apps/pm/wb/backend-configmap.yaml

@@ -0,0 +1,30 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: backend-configmap
+  namespace: pm
+data:
+  uwsgi.ini: |
+    [uwsgi]
+    log-format = {"time": "%(time)", "method": "%(method)", "uri": "%(uri)", "status": "%(status)", "size": "%(size)", "addr": "%(addr)", "user": "%(user)", "proto": "%(proto)", "user_agent": "%(uagent)", "referer": "%(referer)", "trace_id": "%(trace_id)", "span_id": "%(span_id)"}
+    module                 = config.wsgi:application
+    DJANGO_SETTINGS_MODULE = config.settings.base
+    http                   = 0.0.0.0:8000
+    processes              = 8
+    master                 = true
+    vacuum                 = true
+    enable-threads         = true
+    buffer-size            = 65535
+    stats                  = :3031
+    stats-http             = true
+    memory-report          = true
+    lazy-apps              = true
+    listen                 = 1024
+    disable-write-exception= 0
+    harakiri               = 300
+    socket-timeout         = 300
+    chunked-input-timeout  = 300
+    http-timeout           = 300
+    worker-reload-mercy    = 240
+    mule-reload-mercy      = 240

apps/pm/wb/backend.yaml

@@ -0,0 +1,153 @@
+---
+# ENV-файл env-file (secret sarex-env, ключ .env) содержит остальные секреты
+# приложения (DB/S3/Kafka и т.п.) — в дампе кластера Secret'ы не выгружены,
+# сам файл-секрет должен уже существовать в неймспейсе pm.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: pm
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      backend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/pm-backend:production_fa0f1551
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: backend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: backend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: uwsgi-configmap
+              mountPath:
+                _default: /opt/sarex/uwsgi.ini
+              subPath:
+                _default: uwsgi.ini
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: backend-configmap
+                items:
+                  - key: uwsgi.ini
+                    path:
+                      _default: uwsgi.ini
+
+            - name: env-file
+              mountPath:
+                _default: /opt/sarex/.env
+              subPath:
+                _default: .env
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: sarex-env
+                items:
+                  - key: .env
+                    path:
+                      _default: .env
+
+            - name: kafka-cert-volume
+              mountPath:
+                _default: /usr/local/share/ca-certificates
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: kafka-cert
+
+        envs:
+          - name: USERS_INTERNAL_HOST
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+          - name: RESOURCES_INTERNAL_HOST
+            value:
+              _default: "http://resources-service.resources.svc.cluster.local:8000"
+
+          - name: EAV_HOST
+            value:
+              _default: "http://eav-service.eav.svc.cluster.local:8000"
+
+          - name: EAV_API_PREFIX
+            value:
+              _default: "/api/v0"
+
+          - name: EAV_API_PREFIX_V1
+            value:
+              _default: "/api/v1"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/pm/wb/celery.yaml

@@ -0,0 +1,146 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: celery
+  namespace: pm
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      celery:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/pm-backend:production_fa0f1551
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: celery
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          command:
+            _default: ["celery", "-A", "config", "worker", "-B", "-l", "info", "-E", "-Q", "pm", "-n", "default_worker.%h", "--concurrency=2"]
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: false
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: uwsgi-configmap
+              mountPath:
+                _default: /opt/sarex/uwsgi.ini
+              subPath:
+                _default: uwsgi.ini
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: backend-configmap
+                items:
+                  - key: uwsgi.ini
+                    path:
+                      _default: uwsgi.ini
+
+            - name: env-file
+              mountPath:
+                _default: /opt/sarex/.env
+              subPath:
+                _default: .env
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: sarex-env
+                items:
+                  - key: .env
+                    path:
+                      _default: .env
+
+            - name: kafka-cert-volume
+              mountPath:
+                _default: /usr/local/share/ca-certificates
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: kafka-cert
+
+        envs:
+          - name: PLANNING_HOST
+            value:
+              _default: "http://backend-service.pm.svc.cluster.local:8000/api/pm/msp"
+
+          - name: PLANNING_USE
+            value:
+              _default: "True"
+
+          - name: USERS_INTERNAL_HOST
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+          - name: RESOURCES_INTERNAL_HOST
+            value:
+              _default: "http://resources-service.resources.svc.cluster.local:8000"
+
+          - name: EAV_HOST
+            value:
+              _default: "http://eav-service.eav.svc.cluster.local:8000"
+
+          - name: EAV_API_PREFIX
+            value:
+              _default: "/api/v0"
+
+          - name: EAV_API_PREFIX_V1
+            value:
+              _default: "/api/v1"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/pm/wb/kafka-cert-configmap.yaml

@@ -0,0 +1,38 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kafka-cert
+  namespace: pm
+data:
+  kafka.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIIFLTCCAxWgAwIBAgIUYDZPxGRsr7IiqHEmfd07QTQlOKYwDQYJKoZIhvcNAQEN
+    BQAwLTETMBEGA1UECgwKaW8uc3RyaW16aTEWMBQGA1UEAwwNY2x1c3Rlci1jYSB2
+    MDAeFw0yNTEyMTYxNDM0NTVaFw0yNjEyMTYxNDM0NTVaMC0xEzARBgNVBAoMCmlv
+    LnN0cmltemkxFjAUBgNVBAMMDWNsdXN0ZXItY2EgdjAwggIiMA0GCSqGSIb3DQEB
+    AQUAA4ICDwAwggIKAoICAQCfzDZhEzw2pbU5Xpu8OzD+3iQG+DVjU8PQWWQEF27h
+    yjohDkUr3zCZtW7xMKWKUNxBgrKsfe4TDOQN8cij3cS9sy0So+UhMeF7Bq9PU1Yd
+    bmTRq8q1PiuNUkiCGJ5wrb3+NZvVxZLJUIFgiealsRw80MgMWWSzy0I35T2Edn/a
+    DU4jhlgQxyzQ621+oGP0n28gCjmm6pCq2tkj/Z8WTdu1gOWyRdK02a2uE2Ts2nLa
+    Di32GaZrIbIuD/WUd6Ek66uCeJvh2CT7s+SqgtMbtT7gibUuPQ3hk1VGQsjy22l3
+    hUNpLu86nrwbuf21mY55KnLOcaVq1ag1TpIIKfZAL/KWFCGZ6H6kwEIbCAL0Hei7
+    cJ2Wm2/qlzKUeU869M7YybZAfXl/t6XT4QgFgje+42N980vy5A4GhWi1Z7lPqqOe
+    jPGBstkRZybKz1sTk87+oJx82iQU/ozVmzjSEK1SoYRNbvug8PNpxmPoPnJ2flgG
+    t2q2+2ZQP3f1aAHVcZ3U5+hWlRmKPXzjrJv7gnhuvqJl7OwB50y+yWiVfZ9xrYl2
+    EpX+yHuFFK+9NnB5taUK8Fz+hQaLU8J4q7P0bRqkoI+LdcEErjuDT/eI2d5+Ql8K
+    /JkV823hX2WNB9bdaQ24BelVUbsxGpR7ms6KWrM11kHnbzUlEM+AxZES6F7Qbr55
+    TwIDAQABo0UwQzAdBgNVHQ4EFgQUM7hshx7e9TFEN82Pf446aBrJUA4wEgYDVR0T
+    AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQENBQADggIB
+    AFNHFGPDxY966fz0dxDFFSfeo47y7XQZMK9xAwH73cQoSeqx+IMxzgM8nfJQ9XMN
+    PeLwVRZ7pvRee2ZhUPglBSTHnW2rvfmLBOO9xyKZxRsCkoFxuHH9xfM7bFWb96R6
+    fGrOdEZDB3yj00T+tkubwqt+/dUhQUj8juwyPs55WMb/0BIbapaoQ6QOP13CaXDV
+    ZmAfsEEIBkNxfq7GTr/z0Rq0B4+9FxAf3Jrsmi/dYoFD/prHsvBDkYw1daoFyp5C
+    tbctvB9wtphnCCynekt8UBvpVKHUU/xaUa09TQTToXjBbV1SZeIOHNG0MNbWa4sz
+    AL/cpXdq1EAxiTeAVT9XhCwhe/xJvFZIWuFLmW3J+ZxrOUCKieCYpTqBY2tBkkDY
+    //egic787yTR6zxqQNSzvNU5LhzrN7lu+KHGM06T35+HvpzgPPiRCzsxO62p63op
+    mq04K31yYZgLiqeAj5W+rioRGJNn4TXJpH9KIrzmGM7lVWLYWMAKeZU4r1lDUdcu
+    7jsBH8BRJWJeVK3xVw2HB3lk7Xn0WrR92adeYQ3f0vKbMIAVUnSJ3yCKJ4NMFSki
+    j78nx2mi/G0RhUPGZ9hhLXQKj9BtbpEnwpbGWtf0ShtVOxD/HKLCr7koBtW9TMPS
+    9K0sJhE5VjsQLkDDu9p3GdRcuLNA/oa7xFvRFtqGFsLj
+    -----END CERTIFICATE-----

apps/pm/wb/kustomization.yaml

@@ -0,0 +1,10 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: pm
+resources:
+  - backend-configmap.yaml
+  - kafka-cert-configmap.yaml
+  - backend.yaml
+  - celery.yaml
+  - redis.yaml

apps/pm/wb/redis.yaml

@@ -0,0 +1,88 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: redis
+  namespace: pm
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      redis:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/redis:latest
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: redis
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 6379
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: redis
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 6379
+
+          targetPort:
+            _default: 6379
+
+          portName:
+            _default: tcp
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/processing/wb/engine-low.yaml

@@ -0,0 +1,226 @@
+---
+# Сырой Deployment (копия из дампа кластера), а не HelmRelease/universal-chart —
+# см. apps/processing/wb/engine.yaml.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: engine-low
+  namespace: workflow
+  labels:
+    app: engine-low
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: engine-low
+  template:
+    metadata:
+      labels:
+        app: engine-low
+    spec:
+      serviceAccountName: workflows-backend-sa
+      automountServiceAccountToken: true
+      imagePullSecrets:
+        - name: dockerhub
+      containers:
+        - name: engine-low
+          image: cr.yandex/crp3ccidau046kdj8g9q/workflows-engine:production_f5fe4688
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          env:
+            - name: RABBITMQ_HOST
+              value: "rabbitmq-service.workflow.svc.cluster.local"
+            - name: RABBITMQ_PORT
+              value: "5672/api"
+            - name: POSTGRES_ADDRESS
+              value: "sarex-vpsql-01.xc.wb.ru"
+            - name: POSTGRES_PORT
+              value: "5432"
+            - name: POSTGRES_POOL_SIZE
+              value: "20"
+            - name: ENVIRONMENT
+              value: "prod"
+            - name: WORKFLOWS_SENTRY_DSN
+              value: "https://866b532efdbb4764a7551b76231232fc@o279218.ingest.sentry.io/543123"
+            - name: WORKFLOWS_SENTRY_DEBUG
+              value: "0"
+            - name: API_ADDRESS
+              value: "0.0.0.0:8000"
+            - name: DJANGO_HOST
+              value: "http://backend.django.svc.cluster.local:8000"
+            - name: S3_SERVICE_ACCOUNT
+              value: "/etc/sarex/yc-s3/yc-s3-service-account.json"
+            - name: BIM_API_V2_DB
+              value: "/etc/sarex/bim-api-v2-db-prod.json"
+            - name: PDM_API_DB
+              value: "/etc/pdm/pdm-api-db-prod.json"
+            - name: WORKSPACE_API_DB
+              value: "/etc/ws/ws-api-db-prod.json"
+            - name: ISSUE_API_DB
+              value: "/etc/issues/issue-api-db-prod.json"
+            - name: MAILGUN
+              value: "/etc/mailgun-secret/env.json"
+            - name: SMTP
+              value: "/etc/smtp-secret/smtp.json"
+            - name: INTERNAL_PDM_URL
+              value: "http://documentations-api.documentations.svc.cluster.local:8080"
+            - name: INTERNAL_FILESTREAM_URL
+              value: "http://documentations-filestream.documentations.svc.cluster.local:8080"
+            - name: EXTERNAL_PDM_URL
+              value: "http://documentations-api.documentations.svc.cluster.local:8080"
+            - name: EXTERNAL_FILESTREAM_URL
+              value: "http://documentations-filestream-service.documentations.svc.cluster.local:8080"
+            - name: RESOURCES_API_INTERNAL_HOST
+              value: "http://resources-service.resources.svc.cluster.local:8000"
+            - name: ENABLE_SQL_QUERY
+              value: "0"
+            - name: ENABLE_S3_STORAGE
+              value: "1"
+            - name: ENABLE_S3V2_STORAGE
+              value: "1"
+            - name: ENABLE_PDM_STORAGE
+              value: "1"
+            - name: ENABLE_SMTP
+              value: "1"
+            - name: ENABLE_URL_STORAGE
+              value: "1"
+            - name: ENABLE_SRX_TMP
+              value: "1"
+            - name: ENABLE_BIM_API_V2_DB
+              value: "1"
+            - name: ENABLE_WORKSPACE_API_DB
+              value: "1"
+            - name: ENABLE_ISSUE_API_DB
+              value: "1"
+            - name: ENABLE_RESOURCES_API
+              value: "1"
+            - name: ENABLE_PDM_API_DB
+              value: "1"
+            - name: ENABLE_COMPARISONS_API_DB
+              value: "1"
+            - name: ENABLE_MAIL_GUN
+              value: "1"
+            - name: ENABLE_AMQP_EXECUTOR
+              value: "0"
+            - name: ENABLE_KUBERNETES_EXECUTOR
+              value: "1"
+            - name: MAX_WORKFLOWS_LIMIT
+              value: "5"
+            - name: CPU_COUNT
+              value: "1"
+            - name: MEMORY_GI
+              value: "1"
+            - name: CPU_COUNT_LOW_RESOURCES
+              value: "1"
+            - name: MEMORY_GI_LOW_RESOURCES
+              value: "1"
+            - name: CPU_COUNT_HIGH_MEM
+              value: "1"
+            - name: MEMORY_GI_HIGH_MEM
+              value: "1"
+            - name: ENABLE_TOLERATION
+              value: "1"
+            - name: COUNT_RUNNING_WORKERS
+              value: "1"
+            - name: COUNT_CANCELING_WORKERS
+              value: "1"
+            - name: COUNT_HANDLE_JOB_WORKERS
+              value: "1"
+            - name: BIM_API_DEBUG
+              value: "0"
+            - name: BIM_API_V2_DEBUG
+              value: "0"
+            - name: PDM_API_DEBUG
+              value: "0"
+            - name: COMPARISONS_API_DEBUG
+              value: "0"
+            - name: WORKSPACE_API_DEBUG
+              value: "0"
+            - name: JOBS_NAMESPACE
+              value: "workflow"
+            - name: ISSUE_API_DEBUG
+              value: "0"
+            - name: TOLERATION_KEY
+              value: "dedicated"
+            - name: TOLERATION_VALUE
+              value: "processing-light"
+            - name: TOLERATION_KEY_HIGH_MEM
+              value: "dedicated"
+            - name: TOLERATION_VALUE_HIGH_MEM
+              value: "processing-light"
+            - name: TOLERATION_KEY_PERSISTENT
+              value: "dedicated"
+            - name: TOLERATION_VALUE_PERSISTENT
+              value: "processing-light"
+            - name: RABBITMQ_CREATE_EXCHANGE
+              value: "autodesk.inputMessage"
+            - name: RABBITMQ_CANCEL_EXCHANGE
+              value: "autodesk.cancelMessage"
+            - name: RABBITMQ_CREATE_ROUTING_KEY
+              value: "converting"
+            - name: RABBITMQ_CANCEL_TOPIC
+              value: "cancel"
+            - name: RABBITMQ_COMPLETENESS_EXCHANGE
+              value: "autodesk.outputMessage"
+            - name: RABBITMQ_COMPLETENESS_TOPIC
+              value: "output_navis"
+            - name: CONTROL_PLANE_PERIOD
+              value: "10s"
+            - name: WORKFLOW_PRIORITY
+              value: "low"
+            - name: DEFAULT_TOLERATION_KEY
+              value: "dedicated"
+            - name: DEFAULT_TOLERATION_VALUE
+              value: "processing-light"
+            - name: DEFAULT_NODE_SELECTOR_KEY
+              value: "dedicated"
+            - name: DEFAULT_NODE_SELECTOR_VALUE
+              value: "processing-light"
+            - name: RABBITMQ_USER
+              valueFrom:
+                secretKeyRef:
+                  name: rabbitmq-secret
+                  key: username
+            - name: RABBITMQ_PASS
+              valueFrom:
+                secretKeyRef:
+                  name: rabbitmq-secret
+                  key: password
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: postgres-secret
+                  key: username
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: postgres-secret
+                  key: password
+            - name: POSTGRES_DB
+              valueFrom:
+                secretKeyRef:
+                  name: postgres-secret
+                  key: database
+          volumeMounts:
+            - name: yc-s3
+              mountPath: /etc/sarex/yc-s3
+              readOnly: true
+            - name: django-auth
+              mountPath: /etc/django-auth
+              readOnly: true
+            - name: smtp-secret
+              mountPath: /etc/smtp-secret
+              readOnly: true
+      volumes:
+        - name: yc-s3
+          secret:
+            secretName: yc-s3
+        - name: django-auth
+          secret:
+            secretName: django-auth
+        - name: smtp-secret
+          secret:
+            secretName: smtp-secret

apps/processing/wb/engine.yaml

@@ -0,0 +1,223 @@
+---
+# Сырой Deployment (копия из дампа кластера), а не HelmRelease/universal-chart —
+# на universal-chart не удалось надёжно выставить serviceAccountName +
+# automountServiceAccountToken (см. историю в git), решили не гадать дальше.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: engine
+  namespace: workflow
+  labels:
+    app: engine
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: engine
+  template:
+    metadata:
+      labels:
+        app: engine
+    spec:
+      serviceAccountName: workflows-backend-sa
+      automountServiceAccountToken: true
+      imagePullSecrets:
+        - name: dockerhub
+      containers:
+        - name: engine
+          image: cr.yandex/crp3ccidau046kdj8g9q/workflows-engine:production_f5fe4688
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          env:
+            - name: TOLERATION_KEY
+              value: "dedicated"
+            - name: DEFAULT_TOLERATION_KEY
+              value: "dedicated"
+            - name: DEFAULT_TOLERATION_VALUE
+              value: "processing-light"
+            - name: TOLERATION_VALUE
+              value: "processing-light"
+            - name: TOLERATION_KEY_HIGH_MEM
+              value: "dedicated"
+            - name: TOLERATION_VALUE_HIGH_MEM
+              value: "processing-light"
+            - name: TOLERATION_KEY_PERSISTENT
+              value: "dedicated"
+            - name: TOLERATION_VALUE_PERSISTENT
+              value: "processing-light"
+            - name: RABBITMQ_HOST
+              value: "rabbitmq.rabbitmq.svc.cluster.local"
+            - name: RABBITMQ_PORT
+              value: "5672/cad"
+            - name: POSTGRES_ADDRESS
+              value: "sarex-vpsql-01.xc.wb.ru"
+            - name: POSTGRES_PORT
+              value: "5432"
+            - name: WORKFLOWS_SENTRY_DSN
+              value: "https://866b532efdbb4764a7551b76231232fc@o279218.ingest.sentry.io/543123"
+            - name: WORKFLOWS_SENTRY_DEBUG
+              value: "0"
+            - name: POSTGRES_POOL_SIZE
+              value: "20"
+            - name: ENABLE_SMTP
+              value: "1"
+            - name: SMTP
+              value: "/etc/smtp-secret/smtp.json"
+            - name: ENVIRONMENT
+              value: "prod"
+            - name: API_ADDRESS
+              value: "0.0.0.0:8000"
+            - name: DJANGO_HOST
+              value: "http://backend.django.svc.cluster.local:8000"
+            - name: S3_SERVICE_ACCOUNT
+              value: "/etc/sarex/yc-s3/yc-s3-service-account.json"
+            - name: BIM_API_V2_DB
+              value: "/etc/sarex/bim-api-v2-db-prod.json"
+            - name: PDM_API_DB
+              value: "/etc/pdm/pdm-api-db-prod.json"
+            - name: WORKSPACE_API_DB
+              value: "/etc/ws/ws-api-db-prod.json"
+            - name: ISSUE_API_DB
+              value: "/etc/issues/issue-api-db-prod.json"
+            - name: MAILGUN
+              value: "/etc/mailgun-secret/env.json"
+            - name: INTERNAL_PDM_URL
+              value: "http://documentations-api.documentations.svc.cluster.local:8080"
+            - name: INTERNAL_FILESTREAM_URL
+              value: "http://documentations-filestream.documentations.svc.cluster.local:8080"
+            - name: EXTERNAL_PDM_URL
+              value: "http://documentations-api.documentations.svc.cluster.local:8080"
+            - name: EXTERNAL_FILESTREAM_URL
+              value: "http://documentations-filestream-service.documentations.svc.cluster.local:8080"
+            - name: RESOURCES_API_INTERNAL_HOST
+              value: "http://resources-service.resources.svc.cluster.local:8000"
+            - name: ENABLE_SQL_QUERY
+              value: "0"
+            - name: ENABLE_S3_STORAGE
+              value: "1"
+            - name: ENABLE_S3V2_STORAGE
+              value: "1"
+            - name: ENABLE_PDM_STORAGE
+              value: "1"
+            - name: ENABLE_URL_STORAGE
+              value: "1"
+            - name: ENABLE_SRX_TMP
+              value: "1"
+            - name: ENABLE_BIM_API_V2_DB
+              value: "1"
+            - name: ENABLE_WORKSPACE_API_DB
+              value: "1"
+            - name: ENABLE_ISSUE_API_DB
+              value: "1"
+            - name: ENABLE_RESOURCES_API
+              value: "1"
+            - name: ENABLE_PDM_API_DB
+              value: "1"
+            - name: ENABLE_COMPARISONS_API_DB
+              value: "1"
+            - name: ENABLE_MAIL_GUN
+              value: "0"
+            - name: ENABLE_AMQP_EXECUTOR
+              value: "1"
+            - name: ENABLE_KUBERNETES_EXECUTOR
+              value: "1"
+            - name: MAX_WORKFLOWS_LIMIT
+              value: "5"
+            - name: CPU_COUNT
+              value: "1"
+            - name: MEMORY_GI
+              value: "1"
+            - name: CPU_COUNT_LOW_RESOURCES
+              value: "1"
+            - name: MEMORY_GI_LOW_RESOURCES
+              value: "1"
+            - name: CPU_COUNT_HIGH_MEM
+              value: "1"
+            - name: MEMORY_GI_HIGH_MEM
+              value: "1"
+            - name: ENABLE_TOLERATION
+              value: "1"
+            - name: COUNT_RUNNING_WORKERS
+              value: "1"
+            - name: COUNT_CANCELING_WORKERS
+              value: "1"
+            - name: COUNT_HANDLE_JOB_WORKERS
+              value: "1"
+            - name: BIM_API_DEBUG
+              value: "0"
+            - name: BIM_API_V2_DEBUG
+              value: "0"
+            - name: PDM_API_DEBUG
+              value: "0"
+            - name: COMPARISONS_API_DEBUG
+              value: "0"
+            - name: WORKSPACE_API_DEBUG
+              value: "0"
+            - name: JOBS_NAMESPACE
+              value: "workflow"
+            - name: ISSUE_API_DEBUG
+              value: "0"
+            - name: RABBITMQ_CREATE_EXCHANGE
+              value: "autodesk.inputMessage"
+            - name: RABBITMQ_CANCEL_EXCHANGE
+              value: "autodesk.cancelMessage"
+            - name: RABBITMQ_CREATE_ROUTING_KEY
+              value: "converting"
+            - name: RABBITMQ_CANCEL_TOPIC
+              value: "cancel"
+            - name: RABBITMQ_COMPLETENESS_EXCHANGE
+              value: "autodesk.outputMessage"
+            - name: RABBITMQ_COMPLETENESS_TOPIC
+              value: "output"
+            - name: CONTROL_PLANE_PERIOD
+              value: "10s"
+            - name: WORKFLOW_PRIORITY
+              value: "high"
+            - name: RABBITMQ_USER
+              valueFrom:
+                secretKeyRef:
+                  name: rabbitmq-secret
+                  key: username
+            - name: RABBITMQ_PASS
+              valueFrom:
+                secretKeyRef:
+                  name: rabbitmq-secret
+                  key: password
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: postgres-secret
+                  key: username
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: postgres-secret
+                  key: password
+            - name: POSTGRES_DB
+              valueFrom:
+                secretKeyRef:
+                  name: postgres-secret
+                  key: database
+          volumeMounts:
+            - name: yc-s3
+              mountPath: /etc/sarex/yc-s3
+              readOnly: true
+            - name: django-auth
+              mountPath: /etc/django-auth
+              readOnly: true
+            - name: smtp-secret
+              mountPath: /etc/smtp-secret
+              readOnly: true
+      volumes:
+        - name: yc-s3
+          secret:
+            secretName: yc-s3
+        - name: django-auth
+          secret:
+            secretName: django-auth
+        - name: smtp-secret
+          secret:
+            secretName: smtp-secret

apps/processing/wb/frontend.yaml

@@ -0,0 +1,88 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: workflow
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      frontend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/workflows-frontend:ugok2_85f6ce2c
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: frontend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8080
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: frontend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8080
+
+          targetPort:
+            _default: 8080
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/processing/wb/kustomization.yaml

@@ -0,0 +1,11 @@
+---
+# processing разворачивается в wb в неймспейс workflow (не processing).
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: workflow
+resources:
+  - rbac.yaml
+  - engine.yaml
+  - engine-low.yaml
+  - frontend.yaml
+  - workflows-api.yaml

apps/processing/wb/rbac.yaml

@@ -0,0 +1,41 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: workflows-backend-jobs
+  namespace: workflow
+rules:
+  - apiGroups:
+      - batch
+    resources:
+      - jobs
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
+  - apiGroups:
+      - ""
+    resources:
+      - pods
+    verbs:
+      - get
+      - list
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: workflows-backend-jobs
+  namespace: workflow
+subjects:
+  - kind: ServiceAccount
+    name: workflows-backend-sa
+    namespace: workflow
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: workflows-backend-jobs

apps/processing/wb/workflows-api.yaml

@@ -0,0 +1,142 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: workflows-api
+  namespace: workflow
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      workflows-api:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/workflows-api:prod_e963403f
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: workflows-api
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8080
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: workflows-api-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8080
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        envs:
+          - name: POSTGRES_ADDRESS
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: POSTGRES_PORT
+            value:
+              _default: "5432"
+
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "3"
+
+          - name: HTTP_HOST
+            value:
+              _default: "0.0.0.0:8080"
+
+          - name: DJANGO_HOST
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+          - name: S3_SERVICE_ACCOUNT
+            value:
+              _default: "/etc/sarex/yc-s3/yc-s3-service-account.json"
+
+          - name: ENABLE_SQL_QUERY
+            value:
+              _default: "0"
+
+          - name: POSTGRES_SSL_USE
+            value:
+              _default: "0"
+
+        secretEnvs:
+          - name: POSTGRES_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: POSTGRES_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: POSTGRES_DB
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "database"
+
+          - name: PUBLIC_KEY
+            secretName:
+              _default: "public-key"
+            secretKey: "key"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/projects/wb/frontend.yaml

@@ -0,0 +1,95 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: projects-frontend-static
+  namespace: projects
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      projects-frontend-static:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/project-frontend-app:wb_fd49eb19
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: projects-frontend-static
+
+          replicaCount:
+            _default: 2
+
+          port:
+            _default: 80
+
+          resources:
+            requests:
+              cpu:
+                _default: 100m
+              memory:
+                _default: 100Mi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: projects-frontend-static-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/projects/wb/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: projects
+resources:
+  - frontend.yaml

apps/reviews/wb/frontend.yaml

@@ -0,0 +1,95 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: reviews
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      frontend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/reviews-frontend:contour_c5a6d3b4
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: frontend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          resources:
+            requests:
+              cpu:
+                _default: 100m
+              memory:
+                _default: 100Mi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: frontend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/reviews/wb/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: reviews
+resources:
+  - frontend.yaml

apps/rfi/wb/backend.yaml

@@ -0,0 +1,203 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: rfi-backend-api
+  namespace: rfi
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      api:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/rfi-backend:production_d1e2e80d
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: rfi-backend-api
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          resources:
+            requests:
+              cpu:
+                _default: "1"
+              memory:
+                _default: 1Gi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: rfi-backend-api-svc
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        envs:
+          - name: JWT_AUTH_ENABLE
+            value:
+              _default: "True"
+
+          - name: NOTIFICATIONS_ENABLE
+            value:
+              _default: "false"
+
+          - name: NOTIFICATIONS_EMAIL_FROM
+            value:
+              _default: "hello@sarex.io"
+
+          - name: NOTIFICATIONS_SERVICE_URL
+            value:
+              _default: "https://srx.wb.ru/rfi"
+
+          - name: SAREX_BACKEND_URL
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+          - name: EAV_URL
+            value:
+              _default: "http://eav-service.eav.svc.cluster.local:8000"
+
+          - name: GATEWAY_URL
+            value:
+              _default: "http://pdm-api.documentations.svc.cluster.local:8080"
+
+          - name: RABBITMQ_PORT
+            value:
+              _default: "5672"
+
+          - name: RABBITMQ_HOST
+            value:
+              _default: "rabbitmq.rabbitmq.svc.cluster.local"
+
+        secretEnvs:
+          - name: DJANGO_SECRET_KEY
+            secretName:
+              _default: "django-secret"
+            secretKey: "django_secret_key"
+
+          - name: DB_HOST
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "host"
+
+          - name: DB_PORT
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "port"
+
+          - name: DB_NAME
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "dbname"
+
+          - name: DB_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "user"
+
+          - name: DB_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: SAREX_BACKEND_AUTH
+            secretName:
+              _default: "django-secret"
+            secretKey: "token"
+
+          - name: YC_S3_ACCESS_KEY_ID
+            secretName:
+              _default: "s3-secret"
+            secretKey: "key_id"
+
+          - name: YC_S3_SECRET_ACCESS_KEY
+            secretName:
+              _default: "s3-secret"
+            secretKey: "access_key"
+
+          - name: YC_S3_BUCKET_NAME
+            secretName:
+              _default: "s3-secret"
+            secretKey: "storage_bucket_name"
+
+          - name: YC_S3_ENDPOINT_URL
+            secretName:
+              _default: "s3-secret"
+            secretKey: "endpoint_url"
+
+          - name: RABBITMQ_VHOST
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "vhost"
+
+          - name: RABBITMQ_USERNAME
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "username"
+
+          - name: RABBITMQ_PASSWORD
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "password"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/rfi/wb/celery.yaml

@@ -0,0 +1,193 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: celery
+  namespace: rfi
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      celery:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/rfi-backend:dev4
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: celery
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          command:
+            _default: ["uv"]
+          args:
+            _default: ["run", "celery", "-A", "config", "worker", "-l", "info"]
+
+          resources:
+            requests:
+              cpu:
+                _default: "1"
+              memory:
+                _default: 1Gi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: false
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        envs:
+          - name: JWT_AUTH_ENABLE
+            value:
+              _default: "True"
+
+          - name: NOTIFICATIONS_ENABLE
+            value:
+              _default: "false"
+
+          - name: NOTIFICATIONS_EMAIL_FROM
+            value:
+              _default: "hello@sarex.io"
+
+          - name: NOTIFICATIONS_SERVICE_URL
+            value:
+              _default: "https://lk.srx.wb.ru:30443/rfi"
+
+          - name: SAREX_BACKEND_URL
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+          - name: EAV_URL
+            value:
+              _default: "http://eav-service.eav.svc.cluster.local:8000"
+
+          - name: GATEWAY_URL
+            value:
+              _default: "http://pdm-api.documentations.svc.cluster.local:8080"
+
+          - name: RABBITMQ_PORT
+            value:
+              _default: "5672"
+
+          - name: RABBITMQ_HOST
+            value:
+              _default: "rabbitmq.rabbitmq.svc.cluster.local"
+
+        secretEnvs:
+          - name: DJANGO_SECRET_KEY
+            secretName:
+              _default: "django-secret"
+            secretKey: "django_secret_key"
+
+          - name: DB_HOST
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "host"
+
+          - name: DB_PORT
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "port"
+
+          - name: DB_NAME
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "dbname"
+
+          - name: DB_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "user"
+
+          - name: DB_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: SAREX_BACKEND_AUTH
+            secretName:
+              _default: "django-secret"
+            secretKey: "token"
+
+          - name: YC_S3_ACCESS_KEY_ID
+            secretName:
+              _default: "s3-secret"
+            secretKey: "key_id"
+
+          - name: YC_S3_SECRET_ACCESS_KEY
+            secretName:
+              _default: "s3-secret"
+            secretKey: "access_key"
+
+          - name: YC_S3_BUCKET_NAME
+            secretName:
+              _default: "s3-secret"
+            secretKey: "storage_bucket_name"
+
+          - name: YC_S3_ENDPOINT_URL
+            secretName:
+              _default: "s3-secret"
+            secretKey: "endpoint_url"
+
+          - name: RABBITMQ_VHOST
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "vhost"
+
+          - name: RABBITMQ_USERNAME
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "username"
+
+          - name: RABBITMQ_PASSWORD
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "password"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""