++ schedule wb trino coordinator on processing

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.dockerignore

@@ -1,25 +0,0 @@
-# В контекст сборки нужны только манифесты: clusters/, apps/, infrastructure/
-# и скрипты из hack/. Всё остальное — история, IDE, секреты — только раздувает
-# контекст и рискует уехать в образ.
-.git
-.gitignore
-.idea
-.claude
-CLAUDE.md
-.env
-.env.*
-docs
-*.md
-aero
-inventory.yaml
-tmp
-.tmp/
-snapshots
-out
-
-# Секреты и ключи не должны попадать в контекст сборки даже случайно.
-*.pem
-*.key
-*.p12
-kubeconfig*
-*service-account*.json

.gitignore

@@ -2,20 +2,9 @@
 .claude
 CLAUDE.md
 .env
-.env.*
 
 tmp
 .tmp/
 snapshots/*
-
+scripts/.venv
-# Рантайм-артефакты контура aero (gitea-data, k3s-storage, ключи реестра)
+scripts
-# переехали в infra/aero-deploy вместе с docker-compose, который их создаёт.
-# Здесь остаётся только gitea-data: каталог мог остаться от прежней раскладки.
-gitea-data/
-
-# --- Секреты и ключи: не коммитить никогда ---
-*.pem
-*.key
-*.p12
-kubeconfig*
-*service-account*.json

Dockerfile

@@ -1,77 +0,0 @@
-# Полная сборка манифестов IaC-репозитория для одного контура.
-#
-#   docker build --build-arg CONTOUR=aero -t iac:aero .
-#   docker run --rm iac:aero list                  # что собралось
-#   docker run --rm iac:aero cat clusters          # слои Flux одним потоком
-#   docker run --rm -v "$PWD/out:/export" iac:aero export
-#
-# Контур — имя каталога в clusters/ (aero, brusnika-prod, dsinv, wb, ...).
-# Тот же идентификатор служит именем overlay внутри apps/* и infrastructure/*,
-# поэтому одного аргумента хватает на весь рендер.
-#
-# Сборка офлайновая: kustomize build разворачивает оверлеи и патчи, а
-# HelmRelease остаётся Custom Resource'ом — чарты тянет Flux уже в кластере.
-# Ни helm, ни доступ к OCI-реестру здесь не нужны. Исключение — валидация:
-# схемы CRD kubeconform берёт из сети (отключается VALIDATE=0).
-
-ARG KUSTOMIZE_VERSION=v5.4.3
-ARG KUBECONFORM_VERSION=v0.6.7
-
-FROM registry.k8s.io/kustomize/kustomize:${KUSTOMIZE_VERSION} AS kustomize
-FROM ghcr.io/yannh/kubeconform:${KUBECONFORM_VERSION} AS kubeconform
-
-
-FROM alpine:3.20 AS builder
-
-# Контур обязателен по смыслу, но значение по умолчанию оставлено: сборка без
-# --build-arg собирает aero, а не падает на пустой переменной.
-ARG CONTOUR=aero
-ARG VALIDATE=1
-ARG KUBERNETES_VERSION=1.30.0
-
-COPY --from=kustomize /app/kustomize /usr/local/bin/kustomize
-COPY --from=kubeconform /kubeconform /usr/local/bin/kubeconform
-
-WORKDIR /src
-
-# Скрипт копируется отдельным слоем: правка манифестов не инвалидирует его,
-# а правка скрипта не тянет за собой пересборку базовых слоёв.
-COPY hack/render-contour.sh /usr/local/bin/render-contour
-RUN chmod +x /usr/local/bin/render-contour
-
-COPY . .
-
-RUN render-contour "${CONTOUR}" /out
-
-# Валидация отдельным слоем: смена версии Kubernetes не пересобирает рендер.
-# --ignore-missing-schemas пропускает ресурсы, чьих схем нет в каталоге
-# (часть CRD), но не заглушает ошибки в тех, что нашлись.
-RUN if [ "${VALIDATE}" = "1" ]; then \
-      kubeconform \
-        -kubernetes-version "${KUBERNETES_VERSION}" \
-        -strict \
-        -ignore-missing-schemas \
-        -schema-location default \
-        -schema-location 'https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json' \
-        -summary \
-        /out/*.yaml ; \
-    else \
-      echo "VALIDATE=0 — проверка схемами пропущена" ; \
-    fi
-
-
-FROM alpine:3.20
-
-ARG CONTOUR=aero
-ENV CONTOUR=${CONTOUR}
-
-LABEL org.opencontainers.image.title="iac-manifests" \
-      org.opencontainers.image.description="Собранные манифесты контура ${CONTOUR}" \
-      ru.iac.contour="${CONTOUR}"
-
-COPY --from=builder /out /manifests
-COPY hack/entrypoint.sh /usr/local/bin/entrypoint
-RUN chmod +x /usr/local/bin/entrypoint
-
-ENTRYPOINT ["/usr/local/bin/entrypoint"]
-CMD ["list"]

IAC-CATALOG.md

@@ -60,7 +60,7 @@ Superset, Trino, GoAlert, GlitchTip, argo-*, otel-*) **существуют об
 
 | Репозиторий | Зона ответственности | Ключевое содержимое |
 |---|---|---|
-| ★ [infra/iac](https://gitlab.sarex.io/infra/iac) ✅ | **Основной GitOps-монорепозиторий (Flux v2).** Декларативное состояние 9 кластеров: инфраструктурные компоненты + прикладные сервисы. Только манифесты — развёртывание контура aero выделено в [infra/aero-deploy](https://gitlab.sarex.io/infra/aero-deploy) | `clusters/`, `infrastructure/` (36), `apps/` (37), `inventory.yaml`, `docs/apps/` |
+| ★ [infra/iac](https://gitlab.sarex.io/infra/iac) ✅ | **Основной GitOps-монорепозиторий (Flux v2).** Декларативное состояние 9 кластеров: инфраструктурные компоненты + прикладные сервисы | `clusters/`, `infrastructure/` (36), `apps/` (37), `inventory.yaml`, `docs/apps/` |
 | [infra/terraform](https://gitlab.sarex.io/infra/terraform) ✅ | **Ресурсы Yandex Cloud и Kubernetes**: namespaces, PostgreSQL БД/пользователи, S3-бакеты, Valkey/Redis-пользователи, Kafka-топики, RabbitMQ, k8s-секреты. Единый источник правды — `infrastructure.yaml`, секреты через SOPS | `live/prod` (Terragrunt), `modules/`: `k8s-namespace`, `k8s-secret`, `k8s-secrets`, `kafka-topics-yc`, `rabbitmq`, `yc-database`, `yc-s3`, `yc-valkey-user` |
 | [infra/terraform-contour](https://gitlab.sarex.io/infra/terraform-contour) ✅ | Тот же подход **для изолированного контура**: namespaces и секреты из Vault | `live/{namespace,vault-secrets}`, `modules/{k8s-namespace,vault-platform-secrets}` |
 | [infra/terraform-contour-mirror](https://gitlab.sarex.io/infra/terraform-contour-mirror) ✅ | **Зеркало `infra/terraform` для контура** (ветка `contour`, единственная). Тот же README и структура + `Dockerfile` для запуска в закрытом периметре | `live/`, `modules/`, `scripts/`, `Dockerfile` |
@@ -74,7 +74,6 @@ Superset, Trino, GoAlert, GlitchTip, argo-*, otel-*) **существуют об
 
 | Репозиторий | Отвечает за |
 |---|---|
-| [infra/aero-deploy](https://gitlab.sarex.io/infra/aero-deploy) ✅ | **Изолированный контур aero на одном хосте**: ansible-роли (`base`, `docker`, `sarex_stack`) + `docker-compose.yaml` подложки — k3s тремя контейнерами, gitea как источник правды, Vault, bootstrap FluxCD. Манифесты берёт из `infra/iac` (`flux_src_root`) и синхронизирует в gitea контура. Выделен из `infra/iac` |
 | [infra/kubespray](https://gitlab.sarex.io/infra/kubespray) ✅ | Форк upstream Kubespray — **развёртывание самих кластеров Kubernetes** на VM |
 | [infra/k8s-provision](https://gitlab.sarex.io/infra/k8s-provision) ✅ | **Первичная обвязка свежего кластера**: `namespaces`, `cert_manager`, `istio` (+`ISTIO.md`), `ingress`, `dashboard`, `prometheus`, `postgres`/`ya_postgres`, `rabbitmq`, `pvc`, `gitlab`, `teamcity`, `migration` |
 | [infra/ansible-playbooks](https://gitlab.sarex.io/infra/ansible-playbooks) ✅ | Зонтичный Ansible-репозиторий: каталоги `minio/`, `patroni/` |

README.md

@@ -369,23 +369,6 @@ flowchart LR
 │       └── patches/                # Патчи поверх base
 ```
 
-### Чего здесь нет: развёртывание контура aero
-
-Машинерия подъёма самого хоста живёт в отдельном репозитории
-[`infra/aero-deploy`](https://gitlab.sarex.io/infra/aero-deploy): ansible-роли,
-`docker-compose.yaml` подложки (k3s, gitea, vault, bootstrap Flux),
-конфигурация Vault и k3s-манифесты DNS-мостов. Здесь остаётся только то, что
-раскатывает Flux.
-
-Связь между репозиториями односторонняя: роль `sarex_stack` пакует отсюда
-`clusters/aero` и его замыкание (переменная `gitea_sync_paths`) и коммитит в
-gitea внутри контура, откуда это читает Flux. Путь к этому репозиторию роль
-берёт из `flux_src_root`, по умолчанию — соседний каталог `../iac`.
-
-Практическое следствие: **добавили компонент в `clusters/aero/controllers` —
-допишите его в `gitea_sync_paths`** в `aero-deploy`, иначе kustomize в кластере
-упадёт на отсутствующем каталоге. Обратной ссылки нет, и забыть об этом легко.
-
 ## Как это работает
 
 Flux отслеживает директорию `clusters/<имя-кластера>/`. Каждый кластер содержит два Flux Kustomization CRD верхнего уровня:

apps/ams-sync/wb/kustomization.yaml

@@ -1,10 +1,11 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+namespace: ams-sync
 resources:
   - ../base
 patches:
-  - path: istio-gateway.yaml
+  - path: patch.yaml
     target:
       kind: HelmRelease
-      name: ingressgateway
+      name: ams-sync

apps/ams-sync/wb/patch.yaml

@@ -0,0 +1,55 @@
+---
+# Патч для контура wb.
+#
+# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
+# поэтому здесь продублирован весь набор из apps/ams-sync/base/helmrelease.yaml.
+#
+# В base image-тег и USER_SERVER_HOST/AUTH_HOST зашиты под другого клиента
+# (sarex.ugok.lan, образ ams-sync:ugok) — для wb это srx.wb.ru.
+# secretEnvs (telegram/zitadel/kafka/db) не трогаем — они читаются из обычных
+# k8s Secret'ов (не vault-agent), которые в wb уже должны быть заведены отдельно.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: ams-sync
+  namespace: ams-sync
+spec:
+  values:
+    services:
+      backend:
+        envs:
+          - name: AMS_SYNC_TOPIC
+            value:
+              _default: "ams-sync"
+
+          - name: ENVIRONMENT
+            value:
+              _default: "PRODUCTION"
+
+          - name: HOST_ORGANIZATION_ID
+            value:
+              _default: "368536846176636704"
+
+          - name: ALERT_ENABLED
+            value:
+              _default: "False"
+
+          - name: USER_SERVER_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: AUTH_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: VERIFY_USERS
+            value:
+              _default: "True"
+
+          - name: KAFKA_SECURITY_PROTOCOL
+            value:
+              _default: "SSL"
+
+          - name: KAFKA_SASL_MECHANISM
+            value:
+              _default: "SCRAM-SHA-512"

apps/attachments/wb/backend.yaml

@@ -0,0 +1,154 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: attachments
+  namespace: attachments
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      attachments:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/att9:dev
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: attachments
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: attachments-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: yc-s3
+              mountPath:
+                _default: /etc/sarex/yc-s3-storage
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: yc-s3
+
+        envs:
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "10"
+
+          - name: API_ADDRESS
+            value:
+              _default: "0.0.0.0:8000"
+
+          - name: YANDEX_S3_ACCOUNT_PATH
+            value:
+              _default: "/etc/sarex/yc-s3-storage/yc-s3-service-account.json"
+
+          - name: BUCKET_NAME
+            value:
+              _default: "attachments-storage"
+
+          - name: DATABASE_SSL_MODE
+            value:
+              _default: "disable"
+
+          - name: YANDEX_S3_VERIFY
+            value:
+              _default: "false"
+
+          - name: YANDEX_S3_USE_SSL
+            value:
+              _default: "false"
+
+        secretEnvs:
+          - name: DATABASE_HOST
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "host"
+
+          - name: DATABASE_PORT
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "port"
+
+          - name: DATABASE_NAME
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "database"
+
+          - name: DATABASE_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: DATABASE_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/attachments/wb/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: attachments
+resources:
+  - backend.yaml

apps/bim/aero/bim-api.yaml

@@ -1,224 +0,0 @@
----
-# BIM API — приложение из aero/bimbackend (Python, api + worker).
-#
-# ЭТО НЕ ТО ЖЕ, ЧТО apps/bim/base. В base описан platform/bim-backend-v2 —
-# другой сервис, на Go, с единственным httpserver. Спутать их легко: ОБА
-# пушат в реестр один и тот же образ bim-api, и различаются только тегами и
-# содержимым. У bimbackend теги — полный SHA коммита (CI пушит
-# bim-api:${CI_COMMIT_SHA} с master), у bim-backend-v2 — contour_*.
-# Поэтому здесь ../base намеренно НЕ подключён.
-#
-# Манифесты обычные, а не HelmRelease с universal-chart: в репозитории этот
-# сервис так и описан (apps/bim/dsinv), своего чарта у него нет, и заводить
-# его ради контура значило бы поддерживать ещё одну сущность.
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: bim-api-sa
-  namespace: bim
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: bim-api
-  namespace: bim
-  labels:
-    app: bim-api
-spec:
-  replicas: 1
-  revisionHistoryLimit: 10
-  selector:
-    matchLabels:
-      app: bim-api
-  template:
-    metadata:
-      labels:
-        app: bim-api
-      annotations:
-        # Порт Vault исключён из перехвата sidecar'ом: сам Vault живёт вне
-        # кластера, и заворачивать обращения к нему в mesh незачем.
-        traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
-        vault.hashicorp.com/agent-init-first: "true"
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/agent-pre-populate-only: "true"
-        vault.hashicorp.com/auth-path: auth/kubernetes
-        vault.hashicorp.com/role: bim
-        # БД. Имена переменных — DB_*, как их читает settings.py bimbackend,
-        # а не POSTGRES_*, как у остальных приложений контура.
-        vault.hashicorp.com/agent-inject-secret-bim-db: secrets/data/apps/bim/postgres
-        vault.hashicorp.com/agent-inject-template-bim-db: |-
-          {{- with secret "secrets/data/apps/bim/postgres" -}}
-          DB_HOST={{ index .Data.data "host" }}
-          DB_PORT={{ index .Data.data "port" }}
-          DB_USER={{ index .Data.data "username" }}
-          DB_PASSWORD={{ index .Data.data "password" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-bim-rabbitmq: secrets/data/rabbitmq/apps/bim
-        vault.hashicorp.com/agent-inject-template-bim-rabbitmq: |-
-          {{- with secret "secrets/data/rabbitmq/apps/bim" -}}
-          RABBIT_USER={{ index .Data.data "username" }}
-          RABBIT_PASSWORD={{ index .Data.data "password" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-bim-s3: secrets/data/minio/apps/bim
-        vault.hashicorp.com/agent-inject-template-bim-s3: |-
-          {{- with secret "secrets/data/minio/apps/bim" -}}
-          AWS_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
-          AWS_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
-          {{- end -}}
-        # Публичный ключ JWT отдаётся файлом. Оба флага аутентификации ниже
-        # выключены, то есть читаться он не должен, — но путь в переменной
-        # обязан существовать, иначе рискуем падением при импорте настроек.
-        vault.hashicorp.com/agent-inject-secret-jwt-public: secrets/data/vault/common/rsa_keys
-        vault.hashicorp.com/agent-inject-template-jwt-public: |-
-          {{- with secret "secrets/data/vault/common/rsa_keys" -}}
-          {{ index .Data.data "public_key" }}
-          {{- end -}}
-    spec:
-      serviceAccountName: bim-api-sa
-      imagePullSecrets:
-        - name: regcred
-      containers:
-        - name: bim-api
-          # Тег — полный SHA, как их пушит CI aero/bimbackend с master. Именно
-          # этот образ крутится в dsinv. contour_*-теги у образа bim-api брать
-          # НЕЛЬЗЯ: их собирает bim-backend-v2, это чужое приложение.
-          image: cr.yandex/crp3ccidau046kdj8g9q/bim-api:870965d1967cd761965029b0480884ab7fa7c951
-          imagePullPolicy: IfNotPresent
-          # Штатный entrypoint не умеет читать секреты из файлов, поэтому
-          # оборачиваем его: подгружаем отрендеренное vault-агентом и передаём
-          # управление. exec — чтобы приложение осталось процессом с PID 1 и
-          # корректно получало сигналы остановки.
-          command: ["/bin/sh", "-ec"]
-          args:
-            - |
-              set -a
-              [ -f /vault/secrets/bim-db ] && . /vault/secrets/bim-db
-              [ -f /vault/secrets/bim-rabbitmq ] && . /vault/secrets/bim-rabbitmq
-              [ -f /vault/secrets/bim-s3 ] && . /vault/secrets/bim-s3
-              set +a
-              exec ./entrypoint_api.sh
-          ports:
-            - containerPort: 5555
-              name: http
-              protocol: TCP
-            - containerPort: 9000
-              name: prom
-              protocol: TCP
-          env:
-            - name: JWT_PUBLIC_KEY_PATH
-              value: /vault/secrets/jwt-public
-            - name: FEATURE_ENABLE_JWT_AUTH
-              value: "false"
-            - name: FEATURE_ENABLE_SAREX_AUTH
-              value: "false"
-            - name: FEATURE_ENABLE_WORKSPACES
-              value: "true"
-            # Google-хранилища в контуре нет и не будет — флаг выключен.
-            # Том с ключом, который есть в dsinv, здесь не нужен, а сама
-            # переменная ниже нужна, см. комментарий к ней.
-            - name: FEATURE_ENABLE_GCLOUD
-              value: "false"
-            # Значение НЕ УДАЛЯТЬ, даже при выключенном флаге выше. settings.py
-            # делает check_settings(): проходит по всем ключам ENV_FIELDS и
-            # падает на первом же незаданном —
-            #   Exception: ENV_VARIABLE NOT SET: GOOGLE_APPLICATION_CREDENTIALS
-            # Флаги проверяются позже, до них дело не доходит. Файла по этому
-            # пути нет и не будет: при FEATURE_ENABLE_GCLOUD=false его никто не
-            # открывает, важно лишь наличие самой переменной.
-            - name: GOOGLE_APPLICATION_CREDENTIALS
-              value: /etc/sarex/google-storage/service_account.json
-            # ВНИМАНИЕ: S3 в этом приложении НЕ НАСТРАИВАЕТСЯ на MinIO.
-            # В storage/s3.py адрес зашит в код:
-            #   endpoint_url='https://storage.yandexcloud.net'
-            # переменной окружения для него нет. Из контура он недостижим,
-            # поэтому любые операции с файлами будут падать по таймауту —
-            # это принято осознанно, API и остальные эндпоинты живут.
-            # Починить можно только пересборкой образа с вынесенным endpoint
-            # либо переводом на BIM_CURRENT_STORAGE=local (тип есть в
-            # storage/storages.py).
-            - name: FEATURE_ENABLE_S3
-              value: "true"
-            - name: S3_BUCKET
-              value: sarex-media-storage
-            - name: BIM_CURRENT_STORAGE
-              value: s3
-            - name: AWS_DEFAULT_REGION
-              value: ru-central1
-            - name: FEATURE_ENABLE_PROCESSING
-              value: "1"
-            # Адреса смежных сервисов приведены к именам контура. В dsinv это
-            # workflows-service:8000 и workspaces-service:8000 — таких сервисов
-            # здесь нет, оба называются backend-svc и слушают 80.
-            - name: PROCESSING_API_URL
-              value: http://backend-svc.processing.svc.cluster.local:80/internal
-            - name: PROCESSING_C2M_VERSION
-              value: stable
-            - name: WORKSPACES_API_URL
-              value: http://backend-svc.workspaces.svc.cluster.local:80/internal
-            # Сервиса сравнений в контуре нет и не планируется, флага для его
-            # отключения приложение не предоставляет. Имя оставлено говорящим:
-            # в логах будет видно, куда именно оно не достучалось.
-            - name: COMPARATOR_API_URL
-              value: http://comparator-api-service.comparator.svc.cluster.local/internal
-            - name: BIM_API_EXTERNAL_HOST_SCHEMA
-              value: https
-            - name: BIM_API_EXTERNAL_HOST
-              value: bim.sarex.local.lonsdaleites.ru
-            - name: BIM_API_INTERNAL_HOST_SCHEMA
-              value: http
-            - name: BIM_API_INTERNAL_HOST
-              value: bim-api-service.bim.svc.cluster.local:5555
-            - name: WEBHOOK_URL
-              value: http://bim-api-service.bim.svc.cluster.local:5555
-            # Брокер общий, vhost по умолчанию. В dsinv vhost называется api,
-            # но в контуре отдельных vhost'ов нет — см. secrets/rabbitmq/*.
-            - name: RABBIT_HOST
-              value: rabbitmq.rabbitmq.svc.cluster.local:5672
-            - name: RABBIT_VHOST
-              value: "/"
-            - name: MESH_OPTIMIZER_PATH
-              value: gltfpack
-            - name: DEBUG
-              value: "0"
-            - name: STORAGE_SEGMENT
-              value: sarex-production-storage
-            - name: STORAGE_PROJECT
-              value: sarex-production
-            - name: TMP_DIR
-              value: /tmp
-            - name: prometheus_multiproc_dir
-              value: /tmp
-            - name: BUNDLE_VERSION
-              value: v1
-            - name: DISABLE_INSTANCING
-              value: "0"
-          resources:
-            requests:
-              cpu: 25m
-              memory: 200Mi
-          volumeMounts:
-            - mountPath: /tmp
-              name: tmp-volume
-      volumes:
-        - name: tmp-volume
-          emptyDir: {}
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: bim-api-service
-  namespace: bim
-  labels:
-    app: bim-api
-spec:
-  # ClusterIP, а не NodePort с прибитым портом 31352, как в dsinv: наружу
-  # сервис выходит через общий Gateway и VirtualService контура, отдельный
-  # порт на нодах ему не нужен.
-  type: ClusterIP
-  ports:
-    - name: http
-      port: 5555
-      targetPort: 5555
-      protocol: TCP
-  selector:
-    app: bim-api

apps/bim/aero/bim-worker.yaml

@@ -1,157 +0,0 @@
----
-# Воркер bimbackend. Крутит тот же образ и те же настройки, что api, —
-# отличается только точкой входа (entrypoint_worker.sh) и отсутствием портов.
-# Обоснования переменных не дублирую, они в bim-api.yaml.
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: bim-worker-sa
-  namespace: bim
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: bim-worker
-  namespace: bim
-  labels:
-    app: bim-worker
-spec:
-  replicas: 1
-  revisionHistoryLimit: 10
-  selector:
-    matchLabels:
-      app: bim-worker
-  template:
-    metadata:
-      labels:
-        app: bim-worker
-      annotations:
-        traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
-        vault.hashicorp.com/agent-init-first: "true"
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/agent-pre-populate-only: "true"
-        vault.hashicorp.com/auth-path: auth/kubernetes
-        vault.hashicorp.com/role: bim
-        vault.hashicorp.com/agent-inject-secret-bim-db: secrets/data/apps/bim/postgres
-        vault.hashicorp.com/agent-inject-template-bim-db: |-
-          {{- with secret "secrets/data/apps/bim/postgres" -}}
-          DB_HOST={{ index .Data.data "host" }}
-          DB_PORT={{ index .Data.data "port" }}
-          DB_USER={{ index .Data.data "username" }}
-          DB_PASSWORD={{ index .Data.data "password" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-bim-rabbitmq: secrets/data/rabbitmq/apps/bim
-        vault.hashicorp.com/agent-inject-template-bim-rabbitmq: |-
-          {{- with secret "secrets/data/rabbitmq/apps/bim" -}}
-          RABBIT_USER={{ index .Data.data "username" }}
-          RABBIT_PASSWORD={{ index .Data.data "password" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-bim-s3: secrets/data/minio/apps/bim
-        vault.hashicorp.com/agent-inject-template-bim-s3: |-
-          {{- with secret "secrets/data/minio/apps/bim" -}}
-          AWS_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
-          AWS_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
-          {{- end -}}
-        vault.hashicorp.com/agent-inject-secret-jwt-public: secrets/data/vault/common/rsa_keys
-        vault.hashicorp.com/agent-inject-template-jwt-public: |-
-          {{- with secret "secrets/data/vault/common/rsa_keys" -}}
-          {{ index .Data.data "public_key" }}
-          {{- end -}}
-    spec:
-      serviceAccountName: bim-worker-sa
-      imagePullSecrets:
-        - name: regcred
-      containers:
-        - name: bim-worker
-          image: cr.yandex/crp3ccidau046kdj8g9q/bim-api:870965d1967cd761965029b0480884ab7fa7c951
-          imagePullPolicy: IfNotPresent
-          command: ["/bin/sh", "-ec"]
-          args:
-            - |
-              set -a
-              [ -f /vault/secrets/bim-db ] && . /vault/secrets/bim-db
-              [ -f /vault/secrets/bim-rabbitmq ] && . /vault/secrets/bim-rabbitmq
-              [ -f /vault/secrets/bim-s3 ] && . /vault/secrets/bim-s3
-              set +a
-              exec ./entrypoint_worker.sh
-          env:
-            - name: JWT_PUBLIC_KEY_PATH
-              value: /vault/secrets/jwt-public
-            - name: FEATURE_ENABLE_JWT_AUTH
-              value: "false"
-            - name: FEATURE_ENABLE_SAREX_AUTH
-              value: "false"
-            - name: FEATURE_ENABLE_WORKSPACES
-              value: "true"
-            - name: FEATURE_ENABLE_GCLOUD
-              value: "false"
-            # Значение НЕ УДАЛЯТЬ, даже при выключенном флаге выше. settings.py
-            # делает check_settings(): проходит по всем ключам ENV_FIELDS и
-            # падает на первом же незаданном —
-            #   Exception: ENV_VARIABLE NOT SET: GOOGLE_APPLICATION_CREDENTIALS
-            # Флаги проверяются позже, до них дело не доходит. Файла по этому
-            # пути нет и не будет: при FEATURE_ENABLE_GCLOUD=false его никто не
-            # открывает, важно лишь наличие самой переменной.
-            - name: GOOGLE_APPLICATION_CREDENTIALS
-              value: /etc/sarex/google-storage/service_account.json
-            - name: FEATURE_ENABLE_S3
-              value: "true"
-            - name: S3_BUCKET
-              value: sarex-media-storage
-            - name: BIM_CURRENT_STORAGE
-              value: s3
-            - name: AWS_DEFAULT_REGION
-              value: ru-central1
-            - name: FEATURE_ENABLE_PROCESSING
-              value: "1"
-            - name: PROCESSING_API_URL
-              value: http://backend-svc.processing.svc.cluster.local:80/internal
-            - name: PROCESSING_C2M_VERSION
-              value: stable
-            - name: WORKSPACES_API_URL
-              value: http://backend-svc.workspaces.svc.cluster.local:80/internal
-            - name: COMPARATOR_API_URL
-              value: http://comparator-api-service.comparator.svc.cluster.local/internal
-            - name: BIM_API_EXTERNAL_HOST_SCHEMA
-              value: https
-            - name: BIM_API_EXTERNAL_HOST
-              value: bim.sarex.local.lonsdaleites.ru
-            - name: BIM_API_INTERNAL_HOST_SCHEMA
-              value: http
-            - name: BIM_API_INTERNAL_HOST
-              value: bim-api-service.bim.svc.cluster.local:5555
-            - name: WEBHOOK_URL
-              value: http://bim-api-service.bim.svc.cluster.local:5555
-            # В dsinv у воркера здесь rabbitmq-service.bim:5672 — брокера в
-            # namespace bim нет ни там, ни здесь; у api в том же файле адрес
-            # другой и правильный. Ставим общий брокер контура.
-            - name: RABBIT_HOST
-              value: rabbitmq.rabbitmq.svc.cluster.local:5672
-            - name: RABBIT_VHOST
-              value: "/"
-            - name: MESH_OPTIMIZER_PATH
-              value: gltfpack
-            - name: DEBUG
-              value: "0"
-            - name: STORAGE_SEGMENT
-              value: sarex-production-storage
-            - name: STORAGE_PROJECT
-              value: sarex-production
-            - name: TMP_DIR
-              value: /tmp
-            - name: prometheus_multiproc_dir
-              value: /tmp
-            - name: BUNDLE_VERSION
-              value: v1
-            - name: DISABLE_INSTANCING
-              value: "0"
-          resources:
-            requests:
-              cpu: 25m
-              memory: 200Mi
-          volumeMounts:
-            - mountPath: /tmp
-              name: tmp-volume
-      volumes:
-        - name: tmp-volume
-          emptyDir: {}

apps/bim/aero/kustomization.yaml

@@ -1,11 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: bim
-# ../base НЕ подключён намеренно: там описан platform/bim-backend-v2 — другое
-# приложение, которое разворачивать в контуре не нужно. Подробности в шапке
-# bim-api.yaml.
-resources:
-  - namespace.yaml
-  - bim-api.yaml
-  - bim-worker.yaml

apps/bim/aero/namespace.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: bim
-  labels:
-    istio-injection: enabled

apps/bim/wb/backend.yaml

@@ -0,0 +1,222 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: bim
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      backend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/bim-backend-v2:donstroi1
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: backend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: backend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        envs:
+          - name: LAST_MASTER_BIM
+            value:
+              _default: "100000"
+
+          - name: LAST_MASTER_BIM_V3
+            value:
+              _default: "100000"
+
+          - name: LAST_SLAVE_1_BIM
+            value:
+              _default: "1000000"
+
+          - name: POSTGRES_ADDRESS
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: POSTGRES_PORT
+            value:
+              _default: "6432"
+
+          - name: POSTGRES_DB
+            value:
+              _default: "bim_db"
+
+          - name: DB_CERT_PATH_2
+            value:
+              _default: "/root/yandex_pg.pem"
+
+          - name: POSTGRES_ADDRESS_2
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: POSTGRES_PORT_2
+            value:
+              _default: "6432"
+
+          - name: POSTGRES_DB_2
+            value:
+              _default: "bim_db"
+
+          - name: DB_CERT_PATH_3
+            value:
+              _default: "/root/yandex_pg.pem"
+
+          - name: POSTGRES_ADDRESS_3
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: POSTGRES_PORT_3
+            value:
+              _default: "6432"
+
+          - name: POSTGRES_DB_3
+            value:
+              _default: "bim_db"
+
+          - name: DB_CERT_PATH_4
+            value:
+              _default: "/root/yandex_pg.pem"
+
+          - name: POSTGRES_ADDRESS_4
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: POSTGRES_PORT_4
+            value:
+              _default: "6432"
+
+          - name: POSTGRES_DB_4
+            value:
+              _default: "bim_db"
+
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "30"
+
+          - name: API_ADDRESS
+            value:
+              _default: "0.0.0.0:8000"
+
+          - name: DJANGO_HOST
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+          - name: ENABLE_SQL_QUERY
+            value:
+              _default: "0"
+
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+
+        secretEnvs:
+          - name: POSTGRES_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: POSTGRES_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: POSTGRES_USER_2
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: POSTGRES_PASSWORD_2
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: POSTGRES_USER_3
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: POSTGRES_PASSWORD_3
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: POSTGRES_USER_4
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: POSTGRES_PASSWORD_4
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/bim/wb/kustomization.yaml

@@ -1,5 +1,6 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+namespace: bim
 resources:
-  - ../base
+  - backend.yaml

apps/checklists/wb/backend.yaml

@@ -0,0 +1,145 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: checklists-backend
+  namespace: checklists
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      checklists-backend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/checklists-backend:production_68f242cd
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: checklists-backend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: checklists-backend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        envs:
+          - name: HTTP_APP_HOST
+            value:
+              _default: "0.0.0.0"
+
+          - name: HTTP_APP_PORT
+            value:
+              _default: "8000"
+
+          - name: HTTP_APP_ROOT_PATH
+            value:
+              _default: "/checklists"
+
+          - name: HTTP_APP_WORKERS
+            value:
+              _default: "8"
+
+          - name: HTTP_APP_ADMIN_ENABLE
+            value:
+              _default: "true"
+
+          - name: DATABASE_HOST
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: DATABASE_PORT
+            value:
+              _default: "5432"
+
+          - name: DATABASE_NAME
+            value:
+              _default: "checklists_db"
+
+          - name: JWT_AUTH_ENABLE
+            value:
+              _default: "true"
+
+          - name: DEBUG
+            value:
+              _default: "false"
+
+        secretEnvs:
+          - name: DATABASE_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "user"
+
+          - name: DATABASE_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: JWT_AUTH_PUBLIC_KEY
+            secretName:
+              _default: "jwt-secret"
+            secretKey: "public-key"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/checklists/wb/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: checklists
+resources:
+  - backend.yaml

apps/comparisons/wb/backend.yaml

@@ -0,0 +1,94 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: comparisons
+spec:
+  values:
+    services:
+      backend:
+        envs:
+          - name: APP_NAME
+            value:
+              _default: "comparisons"
+
+          - name: APP_VERSION
+            value:
+              _default: "0.0.1"
+
+          - name: LOGGER_LOG_LEVEL
+            value:
+              _default: "info"
+
+          - name: DATABASE_NAME
+            value:
+              _default: "postgres"
+
+          - name: ENABLE_SSL
+            value:
+              _default: "false"
+
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "10"
+
+          - name: HTTP_PORT
+            value:
+              _default: "8000"
+
+          - name: DOCUMENTATIONS_INTERNAL_HOST
+            value:
+              _default: "http://documentations-service.documentations"
+
+          - name: DOCUMENTATIONS_EXTERNAL_HOST
+            value:
+              _default: "https://lk.srx.wb.ru:30443/documentations"
+
+          - name: DOCUMENTATION_FILESTREAM_URL
+            value:
+              _default: "http://backend-filestream-svc.documentations.svc.cluster.local/"
+
+          - name: WORKFLOWS_HOST
+            value:
+              _default: "http://workflows-service.workflow"
+
+          - name: WORKFLOWS_IMAGE_VERSION
+            value:
+              _default: "master"
+
+          - name: WORKFLOWS_DJANGO_HOST
+            value:
+              _default: "https://lk.srx.wb.ru:30443"
+
+          - name: WORKFLOWS_BIMV2_INTERNAL_HOST
+            value:
+              _default: "http://bim-backend-v2-service.bim-api"
+
+          - name: WORKSPACES_HOST
+            value:
+              _default: "http://workspaces-service.workspaces"
+
+          - name: EAV_HOST
+            value:
+              _default: "https://lk.srx.wb.ru:30443/eav"
+
+          - name: LAST_MASTER_BIM
+            value:
+              _default: "36311"
+
+          - name: LAST_SLAVE_1_BIM
+            value:
+              _default: "94015"
+
+          - name: LAST_SLAVE_2_BIM
+            value:
+              _default: "135771"
+
+          - name: ABAP_FIXED_CONC
+            value:
+              _default: "0"
+
+          - name: WORKFLOWS_CONFIG_FILEPATH
+            value:
+              _default: "/etc/app/tasks-execution-config.json"

apps/comparisons/wb/kustomization.yaml

@@ -1,10 +1,11 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+namespace: comparisons
 resources:
   - ../base
 patches:
-  - path: local-path-provisioner.yaml
+  - path: backend.yaml
     target:
       kind: HelmRelease
-      name: local-path-provisioner
+      name: backend

apps/contracts/wb/backend.yaml

@@ -0,0 +1,99 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: contracts
+  namespace: contracts
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      contracts:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/contracts:prod_d3bbd9fc
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: contracts
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8080
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: contracts-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8080
+
+          targetPort:
+            _default: 8080
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        secretEnvs:
+          - name: DB_URL
+            secretName:
+              _default: "ya-pg-secret"
+            secretKey: "db_url"
+
+          - name: PUBLIC_KEY
+            secretName:
+              _default: "public-key"
+            secretKey: "key"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/contracts/wb/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: contracts
+resources:
+  - backend.yaml

apps/django/aero/kustomization.yaml

@@ -1,262 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: django
-resources:
-  - ../base
-
-patches:
-  # Свой nginx.conf вместо базового: в base зашиты upstream'ы на namespace,
-  # которых в контуре нет, и nginx из-за этого не стартовал. Подробности —
-  # в шапке nginx-configmap.yaml.
-  #
-  # ИМЕННО ПАТЧ, а не resources. Объект с тем же kind+name уже пришёл из
-  # ../base, и добавление его вторым ресурсом валит сборку целиком:
-  #   may not add resource with an already registered id:
-  #   ConfigMap.v1.[noGrp]/nginx-configmap.django
-  # Перекрывать базовый ресурс можно только патчем.
-  - path: nginx-configmap.yaml
-    target:
-      kind: ConfigMap
-      name: nginx-configmap
-  # Настройки django: в base захардкожен домен ЧУЖОГО контура. По нему backend
-  # строил абсолютные ссылки на медиа, и браузер уходил на
-  #   https://sarex.contour.infra.sarex.tech/media/state/previews/....png
-  # получая 404. Причина копии та же, что у nginx-configmap: настройки лежат
-  # одним значением data.production.py, заменить можно только целиком.
-  - path: django-configmap.yaml
-    target:
-      kind: ConfigMap
-      name: django-configmap
-  # --- celery: те же правки, что и у backend --------------------------------
-  # Worker крутит тот же образ и те же настройки, поэтому и расхождения с base
-  # у него ровно те же: нет Kafka, нет Zitadel, MinIO живёт внутри кластера.
-  # Обоснования — в блоке backend ниже, здесь не дублирую.
-  #
-  # SERVER_ZITADEL_ENABLED правки не требует: в base у celery он уже "False"
-  # (в отличие от backend).
-  - target: {kind: HelmRelease, name: celery}
-    patch: |
-      - op: remove
-        path: /spec/values/services/celery/podAnnotations/_default/vault.hashicorp.com~1agent-inject-secret-django-kafka
-      - op: remove
-        path: /spec/values/services/celery/podAnnotations/_default/vault.hashicorp.com~1agent-inject-template-django-kafka
-      - op: remove
-        path: /spec/values/services/celery/podAnnotations/_default/vault.hashicorp.com~1agent-inject-secret-django-common
-      - op: remove
-        path: /spec/values/services/celery/podAnnotations/_default/vault.hashicorp.com~1agent-inject-template-django-common
-      - op: replace
-        path: /spec/values/services/celery/podAnnotations/_default/vault.hashicorp.com~1agent-inject-template-django-s3
-        value: |-
-          {{- with secret "secrets/data/minio/apps/django" }}
-          AWS_S3_ENDPOINT_URL=http://minio.minio.svc.cluster.local:9000
-          S3_HOST=http://minio.minio.svc.cluster.local:9000
-          {{- $buckets := index .Data.data "buckets" }}
-          S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }}
-          S3_LOGIN={{ index .Data.data "access_key" }}
-          S3_PASSWORD={{ index .Data.data "secret_key" }}
-          {{- end }}
-
-      # Стартовый скрипт без подключения django-kafka: этого секрета в контуре
-      # нет. migrate и создание администратора сюда НЕ добавляются — схемой
-      # владеет backend, а два процесса, катящих миграции наперегонки при
-      # одновременном старте, — это гонка на ровном месте.
-      - op: replace
-        path: /spec/values/services/celery/deployment/args/_default/0
-        value: |
-          set -a
-          [ -f /vault/secrets/django-postgresql ] && . /vault/secrets/django-postgresql
-          [ -f /vault/secrets/django-rabbitmq ] && . /vault/secrets/django-rabbitmq
-          [ -f /vault/secrets/django-s3 ] && . /vault/secrets/django-s3
-          [ -f /vault/secrets/django-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/django-jwt-private)"
-          [ -f /vault/secrets/django-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/django-jwt-public)"
-          set +a
-          exec celery -A config worker -B -l info -E -Q default -n default_worker.%h --concurrency=2
-
-      # Адреса на wb.sarex.io — чужой контур, из aero недостижим. В base их
-      # четыре, и все четыре у celery: у backend те же переменные уже указывают
-      # внутрь кластера. WORKFLOWS_USE=1, так что оставить как есть — значит
-      # получить зависания на недоступном домене вместо явной ошибки.
-      - op: test
-        path: /spec/values/services/celery/envs/15/name
-        value: SERVER_API_HOST
-      - op: replace
-        path: /spec/values/services/celery/envs/15/value/_default
-        value: https://sarex.local.lonsdaleites.ru
-      - op: test
-        path: /spec/values/services/celery/envs/16/name
-        value: SERVER_HOST
-      - op: replace
-        path: /spec/values/services/celery/envs/16/value/_default
-        value: https://sarex.local.lonsdaleites.ru
-      - op: test
-        path: /spec/values/services/celery/envs/17/name
-        value: WORKFLOWS_HOST
-      - op: replace
-        path: /spec/values/services/celery/envs/17/value/_default
-        value: http://backend-svc.processing.svc.cluster.local:80
-      - op: test
-        path: /spec/values/services/celery/envs/18/name
-        value: WORKFLOWS_BASE_HOST
-      - op: replace
-        path: /spec/values/services/celery/envs/18/value/_default
-        value: http://backend-svc.django.svc.cluster.local:80
-
-      # Тег образа выравнен с backend. В base у celery production_a96dead0, а у
-      # backend production_f813140d — worker и web крутили бы разный код, и
-      # рассинхрон вылезал бы не при старте, а на конкретной задаче: worker
-      # десериализует аргументы по своей версии модели.
-      - op: replace
-        path: /spec/values/services/celery/image/name/_default
-        value: cr.yandex/crp3ccidau046kdj8g9q/backend:production_f813140d
-
-  # --- s3-proxy: S3 внутри кластера ------------------------------------------
-  # В base адрес MinIO зашит ВНУТРИ vault-шаблона:
-  #   AWS_API_ENDPOINT=https://minio.contour.infra.sarex.tech
-  # Это чужой контур. Через values не перекрыть — значение внутри шаблона
-  # аннотации, поэтому заменяем аннотацию целиком, как у backend и celery.
-  #
-  # Проявлялось не отказом в соединении, а тем, что s3-proxy ДОСТУЧАЛСЯ до
-  # чужого MinIO и получил от него настоящий ответ S3:
-  #   SignatureDoesNotMatch: The request signature we calculated does not
-  #   match the signature you provided
-  # наружу это выглядело как 500 на каждую плитку /media/orthophotos/...
-  # Наши ключи в чужом хранилище, разумеется, не подходят — и хорошо, что так:
-  # иначе контур молча читал бы и писал в чужой S3.
-  - target: {kind: HelmRelease, name: s3-proxy}
-    patch: |
-      - op: replace
-        path: /spec/values/services/s3-proxy/podAnnotations/_default/vault.hashicorp.com~1agent-inject-template-s3
-        value: |
-          {{- with secret "secrets/data/minio/apps/django" }}
-          AWS_API_ENDPOINT=http://minio.minio.svc.cluster.local:9000
-          {{- $buckets := index .Data.data "buckets" }}
-          AWS_S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }}
-          AWS_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
-          AWS_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
-          {{- end }}
-
-  # --- backend: убираем зависимости, которых в контуре нет ------------------
-  - target: {kind: HelmRelease, name: backend}
-    patch: |
-      # Kafka и Zitadel в контуре не развёрнуты. Само приложение без них живёт:
-      #   * SERVER_KAFKA_ENABLED в base уже "False", а в sarex-backend продюсер
-      #     создаётся только под флагом (config/settings/deps/kafka.py);
-      #   * zitadel_enabled читается ровно в одном месте — update_ams_user()
-      #     в sarex/core/utils.py, которая при выключенном флаге сразу выходит.
-      #     К аутентификации Zitadel отношения не имеет.
-      #
-      # Но аннотации инжекции убрать ОБЯЗАТЕЛЬНО: vault-agent-init не отрендерит
-      # шаблон для несуществующего секрета, упадёт, и под навсегда останется в
-      # Init:Error — приложение до своих флагов даже не дойдёт.
-      #
-      # В JSON Pointer слэш внутри ключа экранируется как ~1, поэтому
-      # vault.hashicorp.com/agent-... записан как vault.hashicorp.com~1agent-...
-      - op: remove
-        path: /spec/values/services/backend/podAnnotations/_default/vault.hashicorp.com~1agent-inject-secret-django-kafka
-      - op: remove
-        path: /spec/values/services/backend/podAnnotations/_default/vault.hashicorp.com~1agent-inject-template-django-kafka
-      - op: remove
-        path: /spec/values/services/backend/podAnnotations/_default/vault.hashicorp.com~1agent-inject-secret-django-common
-      - op: remove
-        path: /spec/values/services/backend/podAnnotations/_default/vault.hashicorp.com~1agent-inject-template-django-common
-
-      # S3 внутри кластера, а не через внешний домен. В base шаблон прибит к
-      # https://minio.contour.infra.sarex.tech — чужому домену, который отсюда
-      # не резолвится. Через values это не перекрыть: адрес зашит ВНУТРИ
-      # vault-шаблона аннотации, поэтому заменяем аннотацию целиком.
-      # Ходим напрямую в сервис MinIO, как это делал compose-стек.
-      - op: replace
-        path: /spec/values/services/backend/podAnnotations/_default/vault.hashicorp.com~1agent-inject-template-django-s3
-        value: |-
-          {{- with secret "secrets/data/minio/apps/django" }}
-          AWS_S3_ENDPOINT_URL=http://minio.minio.svc.cluster.local:9000
-          S3_HOST=http://minio.minio.svc.cluster.local:9000
-          {{- $buckets := index .Data.data "buckets" }}
-          S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }}
-          S3_LOGIN={{ index .Data.data "access_key" }}
-          S3_PASSWORD={{ index .Data.data "secret_key" }}
-          {{- end }}
-
-      # Выключаем Zitadel. Операция test перед replace — страховка от смещения
-      # индекса: если в base порядок envs изменится, патч упадёт явно, вместо
-      # того чтобы молча перезаписать соседнюю переменную.
-      - op: test
-        path: /spec/values/services/backend/envs/2/name
-        value: SERVER_ZITADEL_ENABLED
-      - op: replace
-        path: /spec/values/services/backend/envs/2/value/_default
-        value: "False"
-
-      # Адреса на чужой контур. У celery те же две переменные поправлены выше,
-      # у backend они оставались с sarex.contour.infra.sarex.tech.
-      - op: test
-        path: /spec/values/services/backend/envs/17/name
-        value: SERVER_API_HOST
-      - op: replace
-        path: /spec/values/services/backend/envs/17/value/_default
-        value: https://sarex.local.lonsdaleites.ru
-      - op: test
-        path: /spec/values/services/backend/envs/18/name
-        value: SERVER_HOST
-      - op: replace
-        path: /spec/values/services/backend/envs/18/value/_default
-        value: https://sarex.local.lonsdaleites.ru
-
-      # --- Администратор платформы --------------------------------------------
-      # Учётка приезжает из Vault под именами, которые ждёт штатная
-      # createsuperuser --noinput. Секрет кладёт ansible
-      # (vault_app_secrets, secrets/apps/django/superuser).
-      - op: add
-        path: /spec/values/services/backend/podAnnotations/_default/vault.hashicorp.com~1agent-inject-secret-django-superuser
-        value: secrets/data/apps/django/superuser
-      - op: add
-        path: /spec/values/services/backend/podAnnotations/_default/vault.hashicorp.com~1agent-inject-template-django-superuser
-        value: |-
-          {{- with secret "secrets/data/apps/django/superuser" -}}
-          DJANGO_SUPERUSER_USERNAME={{ index .Data.data "username" }}
-          DJANGO_SUPERUSER_EMAIL={{ index .Data.data "email" }}
-          DJANGO_SUPERUSER_PASSWORD={{ index .Data.data "password" }}
-          {{- end -}}
-
-      # Стартовый скрипт целиком, а не точечная правка: JSON6902 умеет заменять
-      # только элемент списка, а вся логика запуска — один shell-блок args[0].
-      # Отличия от base:
-      #   * не подключается django-kafka — этого секрета в контуре нет;
-      #   * добавлены migrate и создание администратора.
-      #
-      # Почему migrate здесь, хотя его же делает /opt/sarex/entrypoint.sh:
-      # там он запущен без set -e, и его падение НИКАК не мешает uwsgi
-      # стартовать. Именно так контур несколько часов отдавал 200 на /admin/
-      # с пустой схемой БД, пока backend не мог аутентифицироваться. Здесь
-      # команда выполняется под set -e из command базы (/bin/sh -ec), поэтому
-      # неудача валит под в CrashLoopBackOff — то есть становится видимой.
-      # Повторный прогон внутри entrypoint.sh при уже накатанной схеме
-      # отрабатывает вхолостую за секунды.
-      - op: replace
-        path: /spec/values/services/backend/deployment/args/_default/0
-        value: |
-          set -a
-          [ -f /vault/secrets/django-postgresql ] && . /vault/secrets/django-postgresql
-          [ -f /vault/secrets/django-rabbitmq ] && . /vault/secrets/django-rabbitmq
-          [ -f /vault/secrets/django-s3 ] && . /vault/secrets/django-s3
-          [ -f /vault/secrets/django-superuser ] && . /vault/secrets/django-superuser
-          [ -f /vault/secrets/django-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/django-jwt-private)"
-          [ -f /vault/secrets/django-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/django-jwt-public)"
-          set +a
-
-          python manage.py migrate --noinput
-
-          # Идемпотентно по построению: команда отрабатывает при КАЖДОМ старте
-          # пода, а на уже существующем логине штатно возвращает
-          # "That username is already taken" с ненулевым кодом. Ошибка ожидаема
-          # и гасится веткой else, иначе set -e ронял бы под на втором запуске.
-          if [ -n "${DJANGO_SUPERUSER_USERNAME:-}" ]; then
-            if python manage.py createsuperuser --noinput; then
-              echo "entrypoint: администратор создан"
-            else
-              echo "entrypoint: администратор уже существует, пропускаем"
-            fi
-          fi
-
-          exec /opt/sarex/entrypoint.sh

apps/django/aero/nginx-configmap.yaml

@@ -1,194 +0,0 @@
-# Копия nginx-configmap из base с правками под контур aero.
-#
-# Патчем это сделать нельзя: конфиг лежит одной строкой в data.nginx.conf,
-# и kustomize умеет только заменить значение целиком.
-#
-# ЧТО ИЗМЕНЕНО ОТНОСИТЕЛЬНО base — три вещи:
-#
-# 1. Убран location /api/pm/. Сервис pm в контуре не нужен и не планируется.
-#
-# 2. Для workspaces и processing адрес вынесен в переменную и добавлен
-#    resolver. Причина: nginx резолвит все upstream'ы ПРИ СТАРТЕ и падает
-#    целиком, если хоть один не найден:
-#      nginx: [emerg] host not found in upstream "backend-svc.pm..."
-#    Из-за этого весь frontend уходил в CrashLoopBackOff, хотя не работал
-#    лишь один маршрут. С переменной nginx откладывает резолвинг до запроса:
-#    сейчас эти пути отдают 502, а когда сервисы приедут — заработают сами,
-#    без правки конфига и перезапуска.
-#
-#    ПОРЯДОК ДИРЕКТИВ ВНУТРИ ТАКОГО location ЗНАЧИМ: set обязан идти ДО
-#    rewrite ... break. Обе директивы принадлежат ngx_http_rewrite_module, а
-#    флаг break прекращает обработку его директив в этом location — set после
-#    него просто не выполняется, переменная остаётся пустой, и запрос падает с
-#      [error] no host in upstream ":80"
-#    отдавая наружу 500. Именно так и было: / работал, а /workspaces-v2/... и
-#    /workflows/... возвращали 500, пока set стоял ниже rewrite.
-#
-# 3. backend-svc оставлен прямой ссылкой: он в этом же namespace и существует
-#    всегда, откладывать его резолвинг незачем — наоборот, ошибка в имени
-#    обнаружится сразу при старте.
-#
-# Адрес resolver'а — CoreDNS кластера. В k3s он называется kube-dns
-# (имя сохранено для совместимости), namespace kube-system.
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: nginx-configmap
-  namespace: django
-data:
-  nginx.conf: |
-    worker_processes auto;
-
-    pid /var/run/nginx.pid;
-
-    events {
-        use epoll;
-        worker_connections 1024;
-    }
-
-    http {
-
-        # Basic Settings
-        large_client_header_buffers 8 128k;
-        sendfile on;
-        tcp_nopush on;
-        tcp_nodelay on;
-        keepalive_timeout 300;
-        types_hash_max_size 2048;
-        client_max_body_size 5000M;
-        client_header_buffer_size 5M;
-        include /etc/nginx/mime.types;
-        default_type application/octet-stream;
-
-        # Logging Settings
-        access_log /var/log/nginx/access.log;
-        error_log /var/log/nginx/error.log;
-
-        # GZIP Settings
-        gzip on;
-        gzip_vary on;
-        gzip_proxied any;
-        gzip_comp_level 6;
-        gzip_buffers 16 8k;
-        gzip_http_version 1.1;
-        gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
-
-        log_format main '$remote_addr - $remote_user [$time_local] "$request" '
-                        '$status $body_bytes_sent "$http_referer" '
-                        '"$http_user_agent" "$http_x_forwarded_for"';
-
-        # Резолвер нужен для upstream'ов, заданных переменной (см. ниже).
-        resolver kube-dns.kube-system.svc.cluster.local valid=30s ipv6=off;
-
-        server {
-            listen 80;
-            listen [::]:80;
-            root /opt/react_client/;
-
-            add_header 'Access-Control-Allow-Origin' '*' always;
-            add_header 'Access-Control-Allow-Methods' '*' always;
-            add_header 'Access-Control-Allow-Headers' '*' always;
-
-            location = /static/index.bundle.js {
-                add_header Cache-Control 'no-store no-cache, must-revalidate, proxy-revalidate, max-age=0';
-                if_modified_since off;
-                expires off;
-            }
-
-            # Выбор способа аутентификации. Фронтенд на старте делает
-            # fetch("/static/config.json") и, если там есть auth_type,
-            # БЕЗУСЛОВНО перекрывает им режим, зашитый в сборку
-            # (src/Model/api/http-service.ts). Значения ровно два:
-            # "zitadel" и "original"; original — классический вход по
-            # логину и паролю с JWT, ради которого backend и получает из
-            # Vault ключи RS512.
-            #
-            # В образе sarex-frontend-dev:contour_* этот файл лежит со
-            # значением zitadel и хостом zitadel.contour.infra.sarex.tech —
-            # чужой контур, из aero недоступен. Из-за него платформа
-            # редиректила на /oauth/v2/authorize и получала
-            #   invalid_request: The requested redirect_uri is missing
-            #   in the client configuration
-            # то есть войти было нельзя в принципе.
-            #
-            # Отдаём файл прямо из nginx, не подкладывая том: сам
-            # static/config.json в sarex-frontend лежит в .gitignore и
-            # заполняется на каждом стенде своим — это штатная точка
-            # расширения, а не обход. В апстримном nginx.conf под него уже
-            # заведён такой же location =, только читающий с диска.
-            #
-            # Подменить через localStorage нельзя: оверрайд оттуда
-            # действует лишь для endpoint'ов stage, preprod и local,
-            # contour в этом списке нет.
-            #
-            # ВАЖНО ПРИ ПРОВЕРКЕ: правка НЕ видна с первой перезагрузки.
-            # Класс Config (src/shared/config/config.ts) держит копию в
-            # localStorage под ключом "config" и на старте берёт СИНХРОННО
-            # кеш, а файл сверяет уже асинхронно:
-            #   if (this.cacheData) { this.data = this.cacheData;
-            #                         this.invalidateCache(); }
-            # а http-service.ts читает auth_type в момент импорта модуля.
-            # Поэтому первая загрузка после правки лишь обновляет кеш, а
-            # применяется он со второй. Ускорить —
-            #   localStorage.removeItem('config')
-            # Консоль удобно открыть на /static/config.json: тот же origin,
-            # но JS не выполняется и редиректа на Zitadel не будет.
-            location = /static/config.json {
-                default_type application/json;
-                add_header Cache-Control 'no-store no-cache, must-revalidate, proxy-revalidate, max-age=0';
-                if_modified_since off;
-                expires off;
-                return 200 '{"auth_type":"original"}';
-            }
-
-            # location /api/pm/ из base удалён: сервис pm контуру не нужен.
-
-            location ~^/(api|admin)/ {
-                proxy_http_version 1.1;
-                proxy_set_header Connection "";
-                proxy_set_header Host $host;
-                proxy_pass http://backend-svc.django.svc.cluster.local:80;
-            }
-
-            # workspaces появится позже — резолвим лениво, через переменную.
-            location ~^/workspaces-v2/(.+).js {
-                proxy_http_version 1.1;
-                proxy_set_header Connection "";
-                set $up_workspaces frontend-svc.workspaces.svc.cluster.local;
-                rewrite /workspaces-v2/(.+) /$1 break;
-                proxy_pass http://$up_workspaces:80;
-            }
-
-            location ~^/workspaces-v2/(.+)\.wasm$ {
-                proxy_http_version 1.1;
-                proxy_set_header Connection "";
-                set $up_workspaces_wasm frontend-svc.workspaces.svc.cluster.local;
-                rewrite ^/workspaces-v2/(.+) /$1 break;
-                proxy_pass http://$up_workspaces_wasm:80;
-            }
-
-            location @index {
-                add_header Cache-Control 'no-cache, must-revalidate, proxy-revalidate, max-age=0';
-                if_modified_since off;
-                expires off;
-                try_files /static/index.html =404;
-            }
-
-            # processing появится позже — тоже лениво.
-            location ~^/workflows/(.+).js {
-                proxy_http_version 1.1;
-                proxy_set_header Connection "";
-                set $up_processing frontend-svc.processing.svc.cluster.local;
-                rewrite /workflows/(.+) /$1 break;
-                proxy_pass http://$up_processing:80;
-            }
-
-            location /service-worker.js {
-                try_files /static/$uri @index;
-            }
-
-            location / {
-                try_files $uri @index;
-            }
-        }
-    }

apps/django/wb/auth-flow-frontend.yaml

@@ -0,0 +1,97 @@
+---
+# auth-flow-frontend — компонент приложения auth-flow (apps/auth-flow),
+# в wb развёрнут в ns django, а не в своём собственном неймспейсе.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: auth-flow-frontend
+  namespace: django
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      auth-flow-frontend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/auth-flow-frontend:contour_fe9ea2a3
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: auth-flow-frontend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          resources:
+            requests:
+              cpu:
+                _default: 100m
+              memory:
+                _default: 128Mi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: auth-flow-frontend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/django/wb/backend.yaml

@@ -0,0 +1,444 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: django
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      backend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/backend:production_7d0ec48b
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: backend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: backend-svc
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: tmp-volume
+              mountPath:
+                _default: /tmp
+              emptyDir: {}
+
+            - name: uwsgi-configmap
+              mountPath:
+                _default: /opt/sarex/uwsgi.ini
+              subPath:
+                _default: uwsgi.ini
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: uwsgi-configmap
+                items:
+                  - key: uwsgi.ini
+                    path:
+                      _default: uwsgi.ini
+
+            - name: django-configmap
+              mountPath:
+                _default: /opt/sarex/config/settings/production.py
+              subPath:
+                _default: production.py
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: django-configmap
+                items:
+                  - key: production.py
+                    path:
+                      _default: production.py
+
+            - name: kafka-cert-volume
+              mountPath:
+                _default: /usr/local/share/ca-certificates
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: kafka-cert
+
+        envs:
+          - name: GK_ENCRYPTION_KEY
+            value:
+              _default: "zfDjuszywHSbAhY8KJQbESbpUYN74XTs"
+
+          - name: ALLOWED_HOSTS
+            value:
+              _default: "*"
+
+          - name: SERVER_USE_CHANGELOG
+            value:
+              _default: "0"
+
+          - name: SERVER_ZITADEL_ENABLED
+            value:
+              _default: "True"
+
+          - name: DJANGO_SETTINGS_MODULE
+            value:
+              _default: "config.settings.production"
+
+          - name: CELERY_REDIS_HOST
+            value:
+              _default: "redis-service"
+
+          - name: CELERY_REDIS_PORT
+            value:
+              _default: "6379"
+
+          - name: DJANGO_REDIS_HOST
+            value:
+              _default: "redis-service"
+
+          - name: DJANGO_REDIS_PORT
+            value:
+              _default: "6379"
+
+          - name: BIMV2_INTERNAL_HOST
+            value:
+              _default: "http://bim-backend-v2-service.bim-api"
+
+          - name: BIMV2_TIMEOUT
+            value:
+              _default: "60"
+
+          - name: JWT_KID
+            value:
+              _default: "1"
+
+          - name: PDM_SYNC
+            value:
+              _default: "1"
+
+          - name: KC_SYNC_ENABLE
+            value:
+              _default: "0"
+
+          - name: MEASUREMENTS_HOST
+            value:
+              _default: "http://measurements-service.measurements.svc.cluster.local:8000/api"
+
+          - name: MEASUREMENTS_USE_MEASUREMENTS
+            value:
+              _default: "1"
+
+          - name: SERVER_EXTERNAL_FIND_BY_USERNAME_ENABLED
+            value:
+              _default: "True"
+
+          - name: SERVER_EXTERNAL_FIND_BY_EMAIL_ENABLED
+            value:
+              _default: "True"
+
+          - name: SERVER_API_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: SERVER_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: WORKFLOWS_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: WORKFLOWS_BASE_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: WORKFLOWS_USE
+            value:
+              _default: "1"
+
+          - name: SERVER_S3_STREAM_IMPORT
+            value:
+              _default: "1"
+
+          - name: SERVER_SAVE_DIFF_DEM
+            value:
+              _default: "1"
+
+          - name: SERVER_USE_CLICKHOUSE
+            value:
+              _default: "0"
+
+          - name: SERVER_USE_CREATE_COMPARED_GEOTIFF_TASK
+            value:
+              _default: "0"
+
+          - name: SERVER_USE_DJANGO_STORAGE
+            value:
+              _default: "1"
+
+          - name: SERVER_USE_METASHAPE
+            value:
+              _default: "0"
+
+          - name: SERVER_CHANGELOG_MODE_SYSTEM_LOG
+            value:
+              _default: "1"
+
+          - name: SERVER_CHANGELOG_MODE
+            value:
+              _default: "0"
+
+          - name: SERVER_DJANGO_URLS
+            value:
+              _default: "1"
+
+          - name: CHECK_IMPORT_HASH
+            value:
+              _default: "1"
+
+          - name: EAV_ENABLE
+            value:
+              _default: "1"
+
+          - name: SERVER_CHECK_IMPORT_HASH
+            value:
+              _default: "1"
+
+          - name: SERVER_CHUNKED_PATH
+            value:
+              _default: "/tmp/chunked_uploads/%Y/%m/%d"
+
+          - name: SERVER_HIDE_USER_SCROLL_PERMISSIONS
+            value:
+              _default: "0"
+
+          - name: SERVER_USE_WRORKFLOW_STATUS
+            value:
+              _default: "1"
+
+          - name: ZITADEL_HOST
+            value:
+              _default: "https://zitadel-srx.wb.ru"
+
+          - name: SERVER_KAFKA_ENABLED
+            value:
+              _default: "True"
+
+          - name: KAFKA_TOPICS
+            value:
+              _default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}'
+
+          - name: KAFKA_BOOTSTRAP_SERVERS
+            value:
+              _default: '["wb-prod-kafka-bootstrap.kafka.svc.cluster.local:9093"]'
+
+          - name: KAFKA_SECURITY_PROTOCOL
+            value:
+              _default: "SSL"
+
+          - name: KAFKA_SASL_MECHANISM
+            value:
+              _default: "SCRAM-SHA-512"
+
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: "/usr/local/share/ca-certificates/kafka.crt"
+
+          - name: S3_HOST
+            value:
+              _default: "http://10.49.10.90:9000"
+
+          - name: KC_USE_REDIRECT_LOGOUT
+            value:
+              _default: "False"
+
+        secretEnvs:
+          - name: ZITADEL_ACCESS_TOKEN
+            secretName:
+              _default: "zitadel-secret"
+            secretKey: "access_token"
+
+          - name: KAFKA_SASL_PLAIN_USERNAME
+            secretName:
+              _default: "kafka-secret"
+            secretKey: "username"
+
+          - name: KAFKA_SASL_PLAIN_PASSWORD
+            secretName:
+              _default: "kafka-secret"
+            secretKey: "password"
+
+          - name: KC_CLIENT_ID
+            secretName:
+              _default: "gatekeeper-secret"
+            secretKey: "client_id"
+
+          - name: KC_CLIENT_SECRET
+            secretName:
+              _default: "gatekeeper-secret"
+            secretKey: "client_secret"
+
+          - name: AWS_S3_ENDPOINT_URL
+            secretName:
+              _default: "s3-secret"
+            secretKey: "endpoint"
+
+          - name: CELERY_RABBITMQ_HOST
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "host"
+
+          - name: CELERY_RABBITMQ_USER
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "username"
+
+          - name: CELERY_RABBITMQ_PASSWORD
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "password"
+
+          - name: CELERY_RABBITMQ_VHOST
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "vhost"
+
+          - name: DJANGO_POSTGRES_HOST
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "host"
+
+          - name: DJANGO_POSTGRES_PORTS
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "port"
+
+          - name: DJANGO_POSTGRES_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: DJANGO_POSTGRES_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: DJANGO_POSTGRES_DATABASE
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "database"
+
+          - name: DJANGO_RABBIT_HOSTNAME
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "host"
+
+          - name: DJANGO_RABBIT_USER
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "username"
+
+          - name: DJANGO_RABBIT_PASS
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "password"
+
+          - name: DJANGO_RABBIT_VHOST
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "vhost"
+
+          - name: JWT_PRIVATE_KEY
+            secretName:
+              _default: "backend-secret"
+            secretKey: "ssh_private.key"
+
+          - name: JWT_PUBLIC_KEY
+            secretName:
+              _default: "backend-secret"
+            secretKey: "ssh_public.key"
+
+          - name: S3_BUCKET
+            secretName:
+              _default: "sarex-media-storage-secret"
+            secretKey: "bucket"
+
+          - name: S3_LOGIN
+            secretName:
+              _default: "sarex-media-storage-secret"
+            secretKey: "login"
+
+          - name: S3_PASSWORD
+            secretName:
+              _default: "sarex-media-storage-secret"
+            secretKey: "password"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/django/wb/celery.yaml

@@ -0,0 +1,428 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: celery
+  namespace: django
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      celery:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/backend:production_7d0ec48b
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: celery
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          command:
+            _default: ["celery", "-A", "config", "worker", "-B", "-l", "info", "-E", "-Q", "default", "-n", "default_worker.%h", "--concurrency=2"]
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: false
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: tmp-volume
+              mountPath:
+                _default: /tmp
+              emptyDir: {}
+
+            - name: uwsgi-configmap
+              mountPath:
+                _default: /opt/sarex/uwsgi.ini
+              subPath:
+                _default: uwsgi.ini
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: uwsgi-configmap
+                items:
+                  - key: uwsgi.ini
+                    path:
+                      _default: uwsgi.ini
+
+            - name: django-configmap
+              mountPath:
+                _default: /opt/sarex/config/settings/production.py
+              subPath:
+                _default: production.py
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: django-configmap
+                items:
+                  - key: production.py
+                    path:
+                      _default: production.py
+
+            - name: kafka-cert-volume
+              mountPath:
+                _default: /usr/local/share/ca-certificates
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: kafka-cert
+
+        envs:
+          - name: GK_ENCRYPTION_KEY
+            value:
+              _default: "zfDjuszywHSbAhY8KJQbESbpUYN74XTs"
+
+          - name: ALLOWED_HOSTS
+            value:
+              _default: "*"
+
+          - name: SERVER_USE_CHANGELOG
+            value:
+              _default: "0"
+
+          - name: SERVER_ZITADEL_ENABLED
+            value:
+              _default: "False"
+
+          - name: DJANGO_SETTINGS_MODULE
+            value:
+              _default: "config.settings.production"
+
+          - name: CELERY_REDIS_HOST
+            value:
+              _default: "redis-service"
+
+          - name: CELERY_REDIS_PORT
+            value:
+              _default: "6379"
+
+          - name: DJANGO_REDIS_HOST
+            value:
+              _default: "redis-service"
+
+          - name: CACHE_HOST
+            value:
+              _default: "redis.pm.svc.cluster.local"
+
+          - name: DJANGO_REDIS_PORT
+            value:
+              _default: "6379"
+
+          - name: BIMV2_INTERNAL_HOST
+            value:
+              _default: "http://bim-backend-v2-service.bim-api"
+
+          - name: BIMV2_TIMEOUT
+            value:
+              _default: "60"
+
+          - name: JWT_KID
+            value:
+              _default: "1"
+
+          - name: PDM_SYNC
+            value:
+              _default: "1"
+
+          - name: KC_SYNC_ENABLE
+            value:
+              _default: "0"
+
+          - name: MEASUREMENTS_HOST
+            value:
+              _default: "http://measurements-service.measurements.svc.cluster.local:8000/api"
+
+          - name: MEASUREMENTS_USE_MEASUREMENTS
+            value:
+              _default: "1"
+
+          - name: SERVER_API_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: SERVER_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: WORKFLOWS_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: WORKFLOWS_BASE_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: WORKFLOWS_USE
+            value:
+              _default: "1"
+
+          - name: SERVER_S3_STREAM_IMPORT
+            value:
+              _default: "1"
+
+          - name: SERVER_SAVE_DIFF_DEM
+            value:
+              _default: "1"
+
+          - name: SERVER_USE_CLICKHOUSE
+            value:
+              _default: "0"
+
+          - name: SERVER_USE_CREATE_COMPARED_GEOTIFF_TASK
+            value:
+              _default: "0"
+
+          - name: SERVER_USE_DJANGO_STORAGE
+            value:
+              _default: "1"
+
+          - name: SERVER_USE_METASHAPE
+            value:
+              _default: "0"
+
+          - name: SERVER_CHANGELOG_MODE_SYSTEM_LOG
+            value:
+              _default: "1"
+
+          - name: ZITADEL_HOST
+            value:
+              _default: "https://zitadel-srx.wb.ru"
+
+          - name: SERVER_KAFKA_ENABLED
+            value:
+              _default: "True"
+
+          - name: KAFKA_TOPICS
+            value:
+              _default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}'
+
+          - name: KAFKA_BOOTSTRAP_SERVERS
+            value:
+              _default: '["wb-prod-kafka-bootstrap.kafka.svc.cluster.local:9093"]'
+
+          - name: KAFKA_SECURITY_PROTOCOL
+            value:
+              _default: "SSL"
+
+          - name: KAFKA_SASL_MECHANISM
+            value:
+              _default: "SCRAM-SHA-512"
+
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: "/usr/local/share/ca-certificates/kafka.crt"
+
+          - name: SERVER_CHANGELOG_MODE
+            value:
+              _default: "0"
+
+          - name: SERVER_DJANGO_URLS
+            value:
+              _default: "1"
+
+          - name: CHECK_IMPORT_HASH
+            value:
+              _default: "1"
+
+          - name: EAV_ENABLE
+            value:
+              _default: "1"
+
+          - name: SERVER_CHECK_IMPORT_HASH
+            value:
+              _default: "1"
+
+          - name: SERVER_CHUNKED_PATH
+            value:
+              _default: "/tmp/chunked_uploads/%Y/%m/%d"
+
+          - name: SERVER_HIDE_USER_SCROLL_PERMISSIONS
+            value:
+              _default: "0"
+
+          - name: SERVER_USE_WRORKFLOW_STATUS
+            value:
+              _default: "1"
+
+          - name: S3_HOST
+            value:
+              _default: "http://10.49.10.90:9000"
+
+          - name: KC_USE_REDIRECT_LOGOUT
+            value:
+              _default: "False"
+
+        secretEnvs:
+          - name: ZITADEL_ACCESS_TOKEN
+            secretName:
+              _default: "zitadel-secret"
+            secretKey: "access_token"
+
+          - name: KAFKA_SASL_PLAIN_USERNAME
+            secretName:
+              _default: "kafka-secret"
+            secretKey: "username"
+
+          - name: KAFKA_SASL_PLAIN_PASSWORD
+            secretName:
+              _default: "kafka-secret"
+            secretKey: "password"
+
+          - name: KC_CLIENT_ID
+            secretName:
+              _default: "gatekeeper-secret"
+            secretKey: "client_id"
+
+          - name: KC_CLIENT_SECRET
+            secretName:
+              _default: "gatekeeper-secret"
+            secretKey: "client_secret"
+
+          - name: AWS_S3_ENDPOINT_URL
+            secretName:
+              _default: "s3-secret"
+            secretKey: "endpoint"
+
+          - name: CELERY_RABBITMQ_HOST
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "host"
+
+          - name: CELERY_RABBITMQ_USER
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "username"
+
+          - name: CELERY_RABBITMQ_PASSWORD
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "password"
+
+          - name: CELERY_RABBITMQ_VHOST
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "vhost"
+
+          - name: DJANGO_POSTGRES_HOST
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "host"
+
+          - name: DJANGO_POSTGRES_PORTS
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "port"
+
+          - name: DJANGO_POSTGRES_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: DJANGO_POSTGRES_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: DJANGO_POSTGRES_DATABASE
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "database"
+
+          - name: DJANGO_RABBIT_HOSTNAME
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "host"
+
+          - name: DJANGO_RABBIT_USER
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "username"
+
+          - name: DJANGO_RABBIT_PASS
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "password"
+
+          - name: DJANGO_RABBIT_VHOST
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "vhost"
+
+          - name: JWT_PRIVATE_KEY
+            secretName:
+              _default: "backend-secret"
+            secretKey: "ssh_private.key"
+
+          - name: JWT_PUBLIC_KEY
+            secretName:
+              _default: "backend-secret"
+            secretKey: "ssh_public.key"
+
+          - name: S3_BUCKET
+            secretName:
+              _default: "sarex-media-storage-secret"
+            secretKey: "bucket"
+
+          - name: S3_LOGIN
+            secretName:
+              _default: "sarex-media-storage-secret"
+            secretKey: "login"
+
+          - name: S3_PASSWORD
+            secretName:
+              _default: "sarex-media-storage-secret"
+            secretKey: "password"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/django/wb/django-configmap.yaml

@@ -1,25 +1,4 @@
-# Копия django-configmap из base с заменой домена на домен контура.
+---
-#
-# Патчем этого не сделать: все настройки лежат ОДНИМ значением data.production.py
-# (331 строка python), kustomize умеет заменить его только целиком. Ровно та же
-# причина, что у nginx-configmap.yaml рядом.
-#
-# ЧТО ИЗМЕНЕНО — две строки про домен sarex.contour.infra.sarex.tech,
-# принадлежащий ДРУГОМУ контуру:
-#
-#   HOST                  — по нему backend строит АБСОЛЮТНЫЕ ссылки на медиа.
-#                           Браузер получал
-#                             https://sarex.contour.infra.sarex.tech/media/state/previews/....png
-#                           и, разумеется, 404: чужой хост, наших файлов там нет.
-#   CSRF_TRUSTED_ORIGINS  — без нашего домена django отклонял бы POST-формы
-#                           админки с ошибкой проверки Referer.
-#
-# И один блок сверх того: CsrfExemptSessionAuthentication в
-# DEFAULT_AUTHENTICATION_CLASSES вместо штатного SessionAuthentication —
-# из-за него SPA получала 403 на любое удаление. Обоснование и цена решения
-# расписаны прямо над классом.
-#
-# Больше в файле ничего не менялось: сравнивать с base удобно обычным diff.
 apiVersion: v1
 kind: ConfigMap
 metadata:
@@ -27,57 +6,17 @@ metadata:
   namespace: django
 data:
   production.py: |
-    import ast
+
     import os
     from .base import *
     from logging.handlers import SysLogHandler
     from datetime import timedelta
 
-    def _load_env_file(path):
-        try:
-            with open(path, "r", encoding="utf-8") as f:
-                for raw_line in f:
-                    line = raw_line.strip()
-                    if not line or line.startswith("#") or "=" not in line:
-                        continue
-                    key, value = line.split("=", 1)
-                    key = key.strip()
-                    value = value.strip()
-                    if len(value) >= 2 and value[0] == value[-1] and value[0] in ("'", '"'):
-                        try:
-                            value = ast.literal_eval(value)
-                        except (ValueError, SyntaxError):
-                            value = value[1:-1]
-                    if key and key not in os.environ:
-                        os.environ[key] = value
-        except FileNotFoundError:
-            pass
-
-    def _read_secret_file(path, default=""):
-        try:
-            with open(path, "r", encoding="utf-8") as f:
-                return f.read().strip()
-        except FileNotFoundError:
-            return default
-
-    # Fallback for manage.py launched via `kubectl exec` (outside entrypoint),
-    # so Django can still read DB/JWT values from Vault-injected files.
-    _load_env_file("/vault/secrets/django-postgresql")
-    _load_env_file("/vault/secrets/django-rabbitmq")
-    _load_env_file("/vault/secrets/django-s3")
-    _load_env_file("/vault/secrets/django-kafka")
-    _load_env_file("/vault/secrets/django-common")
-
-    if not os.environ.get("JWT_PRIVATE_KEY"):
-        os.environ["JWT_PRIVATE_KEY"] = _read_secret_file("/vault/secrets/django-jwt-private")
-    if not os.environ.get("JWT_PUBLIC_KEY"):
-        os.environ["JWT_PUBLIC_KEY"] = _read_secret_file("/vault/secrets/django-jwt-public")
-
     ALLOWED_HOSTS = ["*"]
     FILE_UPLOAD_PERMISSIONS = 0o644
     DEBUG = False
     CSRF_COOKIE_SECURE = True
-    CSRF_TRUSTED_ORIGINS = ["https://sarex.local.lonsdaleites.ru", "http://sarex.local.lonsdaleites.ru"]
+    CSRF_TRUSTED_ORIGINS = ["https://lk.srx.wb.ru:30443", "https://lk.srx.wb.ru"]
     SESSION_COOKIE_SECURE = True
     SECURE_SSL_REDIRECT = False
 
@@ -109,7 +48,7 @@ data:
         'Bearer',
     )
 
-    HOST = "https://sarex.local.lonsdaleites.ru"
+    HOST = "https://wb.sarex.io"
 
     POSTGRES_DATABASE = os.environ.get('DJANGO_POSTGRES_DATABASE')
     POSTGRES_USER = os.environ.get('DJANGO_POSTGRES_USER')
@@ -128,11 +67,6 @@ data:
         }
     }
 
-    MEASUREMENTSETTINGS = MeasurementSettings()
-    WORKFLOWSSETTINGS = WorkFlowsSettings()
-    S3SETTINGS = S3Settings()
-    GATEWAYSETTINGS = GateWaySetttings()
-
     LOGGING = {
         'version': 1,
         'disable_existing_loggers': False,
@@ -177,8 +111,8 @@ data:
         'BLACKLIST_AFTER_ROTATION': True,
         'UPDATE_LAST_LOGIN': False,
         'ALGORITHM': 'RS512',
-        'SIGNING_KEY': os.environ.get("JWT_PRIVATE_KEY", "").replace("\\n", "\n"),
+        'SIGNING_KEY': os.environ.get("JWT_PRIVATE_KEY").replace("\\n", "\n"),
-        'VERIFYING_KEY': os.environ.get("JWT_PUBLIC_KEY", "").replace("\\n", "\n"),
+        'VERIFYING_KEY': os.environ.get("JWT_PUBLIC_KEY").replace("\\n", "\n"),
         'AUDIENCE': None,
         'ISSUER': os.environ.get('SIMPLE_JWT_ISSUER', 'default_issuer'),
         'AUTH_HEADER_TYPES': ('Bearer',),
@@ -220,40 +154,6 @@ data:
         },
     }
 
-    # Сессионная аутентификация без проверки CSRF.
-    #
-    # SPA платформы аутентифицируется сессионной кукой и не прикладывает
-    # заголовок X-CSRFToken, а SessionAuthentication из DRF требует его на
-    # любом небезопасном методе. Наружу это выглядело так:
-    #   DELETE /api/core/videos/<id>/  →  403
-    #   {"detail": "CSRF Failed: CSRF token missing."}
-    #
-    # Проверено на контуре: тот же запрос с X-CSRFToken проходит, и он же с
-    # заголовком Authorization: Bearer проходит тоже — до SessionAuthentication
-    # дело в этом случае просто не доходит, потому что simple_jwt в списке ниже
-    # стоит раньше. То есть бэкенд исправен, чинить нужно ровно сочетание
-    # "кука без заголовка".
-    #
-    # ЧЕМ ПЛАТИМ: с запросов, авторизованных кукой, снимается защита от CSRF.
-    # Основной вектор закрыт самими куками — sessionid и csrftoken выставляются
-    # с SameSite=Lax, и браузер не пошлёт их при кросс-сайтовом DELETE. Щель
-    # остаётся одна: SameSite смотрит на site, а не на origin, поэтому соседи
-    # по домену (minio., rabbitmq., dashboard.) считаются "своими", а в MinIO
-    # лежит пользовательский контент.
-    #
-    # Импорт DRF прямо в модуле настроек безопасен НЕ всегда — обычно так и
-    # ловят AppRegistryNotReady. Здесь проверено запуском django.setup() внутри
-    # работающего пода: rest_framework.authentication тянет только
-    # django.contrib.auth и rest_framework.exceptions, и ни один из них к
-    # моделям на уровне модуля не обращается.
-    from rest_framework.authentication import SessionAuthentication
-
-
-    class CsrfExemptSessionAuthentication(SessionAuthentication):
-        def enforce_csrf(self, request):
-            return
-
-
     REST_FRAMEWORK = {      'DEFAULT_PAGINATION_CLASS': (
         'rest_framework.pagination.LimitOffsetPagination'      ),
         'DEFAULT_SCHEMA_CLASS': 'rest_framework.schemas.coreapi.AutoSchema',
@@ -264,7 +164,7 @@ data:
         'rest_framework.authentication.RemoteUserAuthentication',
         'rest_framework_simplejwt.authentication.JWTAuthentication',
         'rest_framework.authentication.BasicAuthentication',
-        'config.settings.production.CsrfExemptSessionAuthentication',
+        'rest_framework.authentication.SessionAuthentication',
         'sarex.authentication.backends.JWTAuthentication'      ],
         'DEFAULT_PERMISSION_CLASSES': [
         'rest_framework.permissions.IsAuthenticated',      ]  }
@@ -328,17 +228,17 @@ data:
             "name": "Замечания",
             "uri": "/remarks"
         },
-        # {
+        {
-        #   "name": "Управление проектами",
+          "name": "Управление проектами",
-        #   "uri": "/management/projects",
+          "uri": "/management/projects",
-        # },
+        },
         {
             "name": "Замечания V2",
             "uri": "/issues"
         },
         {
             "name": "Документация",
-            "uri": "/documentations",
+            "uri": "/documentations"
         },
         {
             "name": "Согласование документов",
@@ -348,35 +248,35 @@ data:
             "name": "Рабочие процессы",
             "uri": "/processes"
         },
-        {
+         {
             "name": "Запросы",
             "uri": "/rfi"
         },
-        {
-            "name": "Управление проектами",
-            "uri": "/management/projects"
-        },
 
+        {
+    		      "name": "Аналитика",
+    		      "uri": "/analytics"
+    		  },
         #  {
         #     "name": "Обзор",
         #     "uri": "/projects"
         # },
         {
-        "name": "Передача документации", 
+          "name": "Передача документации",
-        "uri": "/transmittal"
+          "uri": "/transmittal"
-        },
+          },
     ]
     AUTH_SETTINGS = {
-    "refresh_token": False,
+      "refresh_token": False,
-    "refresh_token_uri": "/api/token/me",
+      "refresh_token_uri": "/api/token/me",
-    "refresh_oauth_token": True,
+      "refresh_oauth_token": True,
-    "refresh_oauth_token_uri": "/oauth/token",
+      "refresh_oauth_token_uri": "/oauth/token",
-    "refresh_time": 240,
+      "refresh_time": 240,
     }
 
 
-    DEBUG=True
+    DEBUG=False
-    WEB_APP_AUTH_MODE='jwt-session-based'
+    #WEB_APP_AUTH_MODE='jwt-session-based'
 
 
     SAREX_MODULES_SETTINGS = {

apps/django/wb/export-project.yaml

@@ -0,0 +1,105 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: export-project
+  namespace: django
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      export-project:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/export-project:prod_ef8aa756
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: export-project
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          resources:
+            limits:
+              cpu:
+                _default: "2"
+              memory:
+                _default: 8Gi
+            requests:
+              cpu:
+                _default: "1"
+              memory:
+                _default: 512Mi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: export-project-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        envs:
+          - name: TIMEOUT
+            value:
+              _default: "180"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/django/wb/frontend.yaml

@@ -0,0 +1,118 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: django
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      frontend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-frontend-dev:contour_5.22.3
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: frontend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: frontend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: nginx-configmap
+              mountPath:
+                _default: /etc/nginx/nginx.conf
+              subPath:
+                _default: nginx.conf
+              configMap:
+                name:
+                  _default: nginx-configmap
+                items:
+                  - key: nginx.conf
+                    path:
+                      _default: nginx.conf
+
+            - name: zitadel-configmap
+              mountPath:
+                _default: /opt/react_client/static/config.json
+              subPath:
+                _default: config.json
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: zitadel-configmap
+                items:
+                  - key: config.json
+                    path:
+                      _default: config.json
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/django/wb/gatekeeper.yaml

@@ -0,0 +1,120 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: gatekeeper
+  namespace: django
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      gatekeeper:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/gatekeeper:2.12.1
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: gatekeeper
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8080
+
+          args:
+            _default:
+              - "--discovery-url=https://keycloak.wildberries.ru/realms/infrastructure/.well-known/openid-configuration"
+              - "--listen=0.0.0.0:8080"
+              - "--enable-logging=true"
+              - "--upstream-url=http://frontend-service.django.svc.cluster.local:80/"
+              - "--enable-refresh-tokens=true"
+              - "--enable-session-cookies=true"
+              - "--verbose"
+              - "--resources=uri=/*"
+              - "--encryption-key=zfDjuszywHSbAhY8KJQbESbpUYN74XTs"
+              - "--secure-cookie=false"
+              - "--cors-origins=*"
+              - "--skip-openid-provider-tls-verify=true"
+              - "--enable-default-deny=false"
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: gatekeeper-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 8080
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        envs:
+          - name: PROXY_REDIRECTION_URL
+            value:
+              _default: "https://lk.srx.wb.ru"
+
+        secretEnvs:
+          - name: PROXY_CLIENT_ID
+            secretName:
+              _default: "gatekeeper-secret"
+            secretKey: "client_id"
+
+          - name: PROXY_CLIENT_SECRET
+            secretName:
+              _default: "gatekeeper-secret"
+            secretKey: "client_secret"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/django/wb/kafka-cert-configmap.yaml

@@ -0,0 +1,38 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kafka-cert
+  namespace: django
+data:
+  kafka.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIIFLTCCAxWgAwIBAgIUYDZPxGRsr7IiqHEmfd07QTQlOKYwDQYJKoZIhvcNAQEN
+    BQAwLTETMBEGA1UECgwKaW8uc3RyaW16aTEWMBQGA1UEAwwNY2x1c3Rlci1jYSB2
+    MDAeFw0yNTEyMTYxNDM0NTVaFw0yNjEyMTYxNDM0NTVaMC0xEzARBgNVBAoMCmlv
+    LnN0cmltemkxFjAUBgNVBAMMDWNsdXN0ZXItY2EgdjAwggIiMA0GCSqGSIb3DQEB
+    AQUAA4ICDwAwggIKAoICAQCfzDZhEzw2pbU5Xpu8OzD+3iQG+DVjU8PQWWQEF27h
+    yjohDkUr3zCZtW7xMKWKUNxBgrKsfe4TDOQN8cij3cS9sy0So+UhMeF7Bq9PU1Yd
+    bmTRq8q1PiuNUkiCGJ5wrb3+NZvVxZLJUIFgiealsRw80MgMWWSzy0I35T2Edn/a
+    DU4jhlgQxyzQ621+oGP0n28gCjmm6pCq2tkj/Z8WTdu1gOWyRdK02a2uE2Ts2nLa
+    Di32GaZrIbIuD/WUd6Ek66uCeJvh2CT7s+SqgtMbtT7gibUuPQ3hk1VGQsjy22l3
+    hUNpLu86nrwbuf21mY55KnLOcaVq1ag1TpIIKfZAL/KWFCGZ6H6kwEIbCAL0Hei7
+    cJ2Wm2/qlzKUeU869M7YybZAfXl/t6XT4QgFgje+42N980vy5A4GhWi1Z7lPqqOe
+    jPGBstkRZybKz1sTk87+oJx82iQU/ozVmzjSEK1SoYRNbvug8PNpxmPoPnJ2flgG
+    t2q2+2ZQP3f1aAHVcZ3U5+hWlRmKPXzjrJv7gnhuvqJl7OwB50y+yWiVfZ9xrYl2
+    EpX+yHuFFK+9NnB5taUK8Fz+hQaLU8J4q7P0bRqkoI+LdcEErjuDT/eI2d5+Ql8K
+    /JkV823hX2WNB9bdaQ24BelVUbsxGpR7ms6KWrM11kHnbzUlEM+AxZES6F7Qbr55
+    TwIDAQABo0UwQzAdBgNVHQ4EFgQUM7hshx7e9TFEN82Pf446aBrJUA4wEgYDVR0T
+    AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQENBQADggIB
+    AFNHFGPDxY966fz0dxDFFSfeo47y7XQZMK9xAwH73cQoSeqx+IMxzgM8nfJQ9XMN
+    PeLwVRZ7pvRee2ZhUPglBSTHnW2rvfmLBOO9xyKZxRsCkoFxuHH9xfM7bFWb96R6
+    fGrOdEZDB3yj00T+tkubwqt+/dUhQUj8juwyPs55WMb/0BIbapaoQ6QOP13CaXDV
+    ZmAfsEEIBkNxfq7GTr/z0Rq0B4+9FxAf3Jrsmi/dYoFD/prHsvBDkYw1daoFyp5C
+    tbctvB9wtphnCCynekt8UBvpVKHUU/xaUa09TQTToXjBbV1SZeIOHNG0MNbWa4sz
+    AL/cpXdq1EAxiTeAVT9XhCwhe/xJvFZIWuFLmW3J+ZxrOUCKieCYpTqBY2tBkkDY
+    //egic787yTR6zxqQNSzvNU5LhzrN7lu+KHGM06T35+HvpzgPPiRCzsxO62p63op
+    mq04K31yYZgLiqeAj5W+rioRGJNn4TXJpH9KIrzmGM7lVWLYWMAKeZU4r1lDUdcu
+    7jsBH8BRJWJeVK3xVw2HB3lk7Xn0WrR92adeYQ3f0vKbMIAVUnSJ3yCKJ4NMFSki
+    j78nx2mi/G0RhUPGZ9hhLXQKj9BtbpEnwpbGWtf0ShtVOxD/HKLCr7koBtW9TMPS
+    9K0sJhE5VjsQLkDDu9p3GdRcuLNA/oa7xFvRFtqGFsLj
+    -----END CERTIFICATE-----

apps/django/wb/kustomization.yaml

@@ -0,0 +1,20 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: django
+resources:
+  - django-configmap.yaml
+  - uwsgi-configmap.yaml
+  - zitadel-configmap.yaml
+  - nginx-configmap.yaml
+  - kafka-cert-configmap.yaml
+  - backend.yaml
+  - celery.yaml
+  - export-project.yaml
+  - frontend.yaml
+  - gatekeeper.yaml
+  - measurement.yaml
+  - redis.yaml
+  - s3-proxy.yaml
+  - srx-admin.yaml
+  - auth-flow-frontend.yaml

apps/django/wb/measurement.yaml

@@ -0,0 +1,112 @@
+---
+# measurement — компонент приложения measurements (apps/measurements),
+# в wb развёрнут в ns django, а не в своём собственном неймспейсе.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: measurement
+  namespace: django
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      measurement:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/measurements:prod_ece72657
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: measurement
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: measurement-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: tmp-volume
+              mountPath:
+                _default: /tmp
+              emptyDir: {}
+
+        envs:
+          - name: DJANGO_HOST
+            value:
+              _default: "https://lk.srx.wb.ru:30443"
+
+          - name: S3_JSON_FILE
+            value:
+              _default: "/opt/cred_s3.json"
+
+        secretEnvs:
+          - name: S3_JSON_SETTINGS
+            secretName:
+              _default: "s3-json-settings"
+            secretKey: "S3_JSON_SETTINGS"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/django/wb/nginx-configmap.yaml

@@ -0,0 +1,180 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nginx-configmap
+  namespace: django
+data:
+  nginx.conf: |
+    worker_processes auto;
+
+    pid /var/run/nginx.pid;
+
+    events {
+        use epoll;
+        worker_connections 1024;
+    }
+
+    http {
+
+        # Basic Settings
+        large_client_header_buffers 8 128k;
+        sendfile on;
+        tcp_nopush on;
+        tcp_nodelay on;
+        keepalive_timeout 300;
+        types_hash_max_size 2048;
+        client_max_body_size 5000M;
+        client_header_buffer_size 5M;
+        # server_tokens off;
+        # server_names_hash_bucket_size 64;
+        # server_name_in_redirect off;
+        include /etc/nginx/mime.types;
+        default_type application/octet-stream;
+
+        # Logging Settings
+        access_log /var/log/nginx/access.log;
+        error_log /var/log/nginx/error.log;
+
+        # GZIP Settings
+        gzip on;
+        gzip_vary on;
+        gzip_proxied any;
+        gzip_comp_level 6;
+        gzip_buffers 16 8k;
+        gzip_http_version 1.1;
+        gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
+
+        log_format main '$remote_addr - $remote_user [$time_local] "$request" '
+                        '$status $body_bytes_sent "$http_referer" '
+                        '"$http_user_agent" "$http_x_forwarded_for"';
+
+        server {
+            listen 80;
+            listen [::]:80;
+            root /opt/react_client/;
+
+            add_header 'Access-Control-Allow-Origin' '*' always;
+            add_header 'Access-Control-Allow-Methods' '*' always;
+            add_header 'Access-Control-Allow-Headers' '*' always;
+
+            location = /static/index.bundle.js {
+                add_header Cache-Control 'no-store no-cache, must-revalidate, proxy-revalidate, max-age=0';
+                if_modified_since off;
+                expires off;
+            }
+
+            location = /static/pdf-runtime/assets/mupdf-wasm.wasm {
+                alias /opt/react_client/static/pdf-runtime/assets/mupdf-wasm.wasm;
+                add_header Content-Type application/wasm always;
+                add_header Cache-Control "public, max-age=31536000, immutable" always;
+                add_header Access-Control-Allow-Origin "*" always;
+                add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+                add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
+            }
+
+            location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.js {
+                alias /opt/react_client/static/viewer-pdf/mupdf-wasm.js;
+                add_header Content-Type application/javascript always;
+                add_header Cache-Control "public, max-age=31536000, immutable" always;
+                add_header Access-Control-Allow-Origin "*" always;
+                add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+                add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
+            }
+
+            location = /workspaces-v2/worker/mupdf.worker-3.3.9.js {
+                alias /opt/react_client/static/pdf-runtime/mupdf.worker-3.3.9.js;
+                add_header Content-Type application/javascript always;
+                add_header Cache-Control "public, max-age=31536000, immutable" always;
+                add_header Access-Control-Allow-Origin "*" always;
+                add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+                add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
+            }
+
+            location = /workspaces-v2/worker/static/viewer-pdf/mupdf.js {
+                alias /opt/react_client/static/viewer-pdf/mupdf.js;
+                add_header Content-Type application/javascript always;
+                add_header Cache-Control "public, max-age=31536000, immutable" always;
+                add_header Access-Control-Allow-Origin "*" always;
+                add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+                add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
+            }
+
+            location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.wasm {
+                add_header Content-Type application/wasm always;
+                alias /opt/react_client/static/viewer-pdf/mupdf-wasm.wasm;
+            }
+            location ~^/api/pm/ {
+                #rewrite /api/(.+) /$1 break;
+                proxy_set_header Host $host;
+                proxy_pass http://backend-service.pm.svc.cluster.local:8000;
+            }
+
+            location ~^/media/ {
+                rewrite ^/media/(.*)$ /$1 break;
+                proxy_set_header Host $host;
+                proxy_pass http://s3-proxy-service:80;
+            }
+
+            location ~^/api/v1/documents/ {
+                #rewrite /api/(.+) /$1 break;
+                proxy_set_header Host $host;
+                proxy_pass http://documentations-filestream.documentations.svc.cluster.local:8080;
+            }
+
+            location ~^/(api|admin)/ {
+                proxy_set_header Host $host;
+                proxy_pass http://backend:8000;
+            }
+
+            # location ~^/flows/static/ {
+            #      rewrite /flows/static/(.+) /$1 break;
+            #      proxy_pass http://frontend-service.flows:80;
+            # }
+
+            #  location = ~^/orchestrator/ {
+            # rewrite ^/orchestrator$ /api/ break;
+            # proxy_pass http://cde.orchestrator.svc.cluster.local:8080;
+            # }
+
+            # location = ~^/orchestrator/api/process {
+            #     rewrite ^/orchestrator/api/process$ /api/process break;
+            #     proxy_pass http://cde.orchestrator.svc.cluster.local:8080;
+            # }
+
+            # location ~ ^/orchestrator/api/process/(.*)$ {
+            #     rewrite ^/orchestrator/api/process/(.*)$ /api/process/$1 break;
+            #     proxy_pass http://cde.orchestrator.svc.cluster.local:8080;
+            # }
+
+            # location = ~^/orchestrator/api/sign {
+            #     rewrite ^/orchestrator/api/sign$ /api/sign break;
+            #     proxy_pass http://cde.orchestrator.svc.cluster.local:8080;
+            # }
+
+
+            location ~^/workspaces-v2/(.+).js {
+                rewrite /workspaces-v2/(.+) /$1 break;
+                proxy_pass http://workspaces-v2-frontend-static-service.workspaces.svc.cluster.local:8080;
+            }
+
+            location @index {
+                add_header Cache-Control 'no-cache, must-revalidate, proxy-revalidate, max-age=0';
+                if_modified_since off;
+                expires off;
+                try_files /static/index.html =404;
+            }
+
+            location ~^/workflows/(.+).js {
+                 rewrite /workflows/(.+) /$1 break;
+                 proxy_pass http://frontend-service.workflow.svc.cluster.local:8080;
+            }
+            location /service-worker.js {
+                try_files /static/$uri @index;
+            }
+
+            location / {
+                try_files $uri @index;
+            }
+        }
+    }

apps/django/wb/redis.yaml

@@ -0,0 +1,88 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: redis
+  namespace: django
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      redis:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/redis:latest
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: redis
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 6379
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: redis-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 6379
+
+          targetPort:
+            _default: 6379
+
+          portName:
+            _default: tcp
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/django/wb/s3-proxy.yaml

@@ -0,0 +1,117 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: s3-proxy
+  namespace: django
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      s3-proxy:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/s3-proxy:stable
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: s3-proxy
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: s3-proxy-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        envs:
+          - name: AWS_API_ENDPOINT
+            value:
+              _default: "http://10.49.10.90:9000"
+
+          - name: ACCESS_LOG
+            value:
+              _default: "true"
+
+          - name: CORS_ALLOW_HEADERS
+            value:
+              _default: "Content-Type, Accept-Ranges, Content-Range, Content-Encoding"
+
+        secretEnvs:
+          - name: AWS_ACCESS_KEY_ID
+            secretName:
+              _default: "sarex-media-storage-secret"
+            secretKey: "login"
+
+          - name: AWS_SECRET_ACCESS_KEY
+            secretName:
+              _default: "sarex-media-storage-secret"
+            secretKey: "password"
+
+          - name: AWS_S3_BUCKET
+            secretName:
+              _default: "sarex-media-storage-secret"
+            secretKey: "bucket"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/django/wb/srx-admin.yaml

@@ -0,0 +1,95 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: srx-admin
+  namespace: django
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      srx-admin:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/srx-admin:prod_638c3442
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: srx-admin
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: srx-admin-svc
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8080
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: tmp-volume
+              mountPath:
+                _default: /tmp
+              emptyDir: {}
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/django/wb/uwsgi-configmap.yaml

@@ -0,0 +1,31 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: uwsgi-configmap
+  namespace: django
+data:
+  uwsgi.ini: |
+    [uwsgi]
+    module                 = config.wsgi:application
+    DJANGO_SETTINGS_MODULE = config.settings.production
+    http                   = 0.0.0.0:8000
+    processes              = 16
+    master                 = true
+    vacuum                 = true
+    enable-threads         = true
+    buffer-size            = 65535
+    stats                  = :3031
+    stats-http             = true
+    memory-report          = true
+    lazy-apps              = true
+    listen                 = 128
+    disable-write-exception= 0
+    harakiri               = 300
+    socket-timeout         = 300
+    chunked-input-timeout  = 300
+    http-timeout           = 300
+    worker-reload-mercy    = 240
+    mule-reload-mercy      = 240
+    static-map = /static=/opt/sarex/sarex/static/
+    static-map = /media=/media/

apps/django/wb/zitadel-configmap.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: zitadel-configmap
+  namespace: django
+data:
+  config.json: |-
+    {
+      "auth_type": "zitadel",
+      "zitadel": {
+        "client_id": "363741990556356237",
+        "host": "https://zitadel-srx.wb.ru"
+      }
+    }

apps/documentations/base/pdm.yaml

@@ -64,7 +64,7 @@ spec:
               enabled: false
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/pdmv2:prod_38958427
+            _default: cr.yandex/crp3ccidau046kdj8g9q/pdmv2:prod_9507c2d5
           pullPolicy:
             _default: IfNotPresent
         service:
@@ -183,7 +183,7 @@ spec:
               _default: INFO
           - name: NOTES_URL
             value:
-              _default: ""
+              _default: "mock"
           - name: OBSERVABILITY_COLLECTOR_ENDPOINT
             value:
               _default: temp

apps/documentations/brusnika-prod/api.yaml

@@ -212,6 +212,10 @@ spec:
             value:
               _default: "v1"
 
+          - name: USE_MARKS_RABBITMQ
+            value:
+              _default: "true"
+
           - name: SYSTEM_LOG_URL
             value:
               _default: "http://api-service.system-log.svc.cluster.local:80"
@@ -293,6 +297,32 @@ spec:
             secretName:
               _default: "django-auth"
             secretKey: "key"
+          
+          - name: MARKS_RABBITMQ_HOST
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "host"
+          
+          - name: MARKS_RABBITMQ_PASSWORD
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "password"
+          
+          - name: MARKS_RABBITMQ_USER
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "username"
+
+          - name: MARKS_RABBITMQ_API
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "vhost"
+          
+          - name: MARKS_RABBITMQ_PORT
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "port"
+
 
           - name: DJANGO_BASIC_AUTH_FOR_GET_USER
             secretName:

apps/documentations/brusnika-prod/hasher.yaml

@@ -0,0 +1,186 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: documentations-hasher
+  namespace: documentations
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+  driftDetection:
+    mode: enabled
+
+  values:
+    global:
+      env: _default
+
+    services:
+      backend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/hasher:production_3f853d3a
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: hasher
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8080
+
+          command:
+            _default: ["run-amqp-server"]
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: hasher-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8080
+
+          targetPort:
+            _default: 8080
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: regcred
+
+        labels:
+          monitoring: prometheus
+
+        envs:
+          - name: HASHER_APP__LOG_LEVEL
+            value:
+              _default: "INFO"
+
+          - name: HASHER_APP__NUM_WORKERS
+            value:
+              _default: "4"
+
+          - name: HASHER_AMQP__ROUTING__TASK_INPUT_QUEUE
+            value:
+              _default: "hash.compute.normal.tasks"
+
+          - name: HASHER_AMQP__ROUTING__TASK_INPUT_EXCHANGE
+            value:
+              _default: "hash.compute"
+
+          - name: HASHER_AMQP__ROUTING__TASK_INPUT_EXCHANGE_TYPE
+            value:
+              _default: "direct"
+
+          - name: HASHER_AMQP__ROUTING__TASK_INPUT_ROUTING_KEY
+            value:
+              _default: "hash.compute.normal"
+
+          - name: HASHER_S3__MAX_POOL_CONNECTIONS
+            value:
+              _default: "10"
+
+          - name: HASHER_S3__CONNECT_TIMEOUT
+            value:
+              _default: "10"
+
+          - name: HASHER_S3__READ_TIMEOUT
+            value:
+              _default: "30"
+
+          - name: HASHER_S3__REGION_NAME
+            value:
+              _default: "ru-central1"
+
+          - name: HASHER_S3__USE_SSL
+            value:
+              _default: "true"
+
+          - name: HASHER_S3__VERIFY
+            value:
+              _default: "true"
+
+        secretEnvs:
+          - name: HASHER_AMQP__HOST
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "host"
+
+          - name: HASHER_AMQP__PORT
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "port"
+
+          - name: HASHER_AMQP__USERNAME
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "username"
+
+          - name: HASHER_AMQP__PASSWORD
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "password"
+
+          - name: HASHER_AMQP__VHOST
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "vhost"
+
+          - name: HASHER_S3__ENDPOINT
+            secretName:
+              _default: "hasher-s3-secret"
+            secretKey: "endpoint"
+
+          - name: HASHER_S3__ACCESS_KEY
+            secretName:
+              _default: "hasher-s3-secret"
+            secretKey: "access_key"
+
+          - name: HASHER_S3__SECRET_KEY
+            secretName:
+              _default: "hasher-s3-secret"
+            secretKey: "secret_key"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/documentations/brusnika-prod/kustomization.yaml

@@ -7,3 +7,4 @@ resources:
   - pdm.yaml
   - api.yaml
   - filestream.yaml
+  - hasher.yaml

apps/documentations/wb/api.yaml

@@ -0,0 +1,335 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: documentations-api
+  namespace: documentations
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      documentations-api:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_179e518c
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: documentations-api
+
+          replicaCount:
+            _default: 3
+
+          port:
+            _default: 8080
+
+          resources:
+            requests:
+              cpu:
+                _default: 300m
+              memory:
+                _default: 300Mi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: documentations-api
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8080
+
+          targetPort:
+            _default: 8080
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: documentations-yc-s3-secret
+              mountPath:
+                _default: /etc/sarex/yc-s3-storage
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: documentations-yc-s3
+
+            - name: zitadel-account
+              mountPath:
+                _default: /etc/sarex/zitadel
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: zitadel-account
+
+        envs:
+          - name: POSTGRES_ADDRESS
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: POSTGRES_PORT
+            value:
+              _default: "5432"
+
+          - name: POSTGRES_DB
+            value:
+              _default: "documentations_db"
+
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "20"
+
+          - name: ZITADEL_ACCOUNT
+            value:
+              _default: "/etc/sarex/zitadel/zitadel-account.json"
+
+          - name: ZITADEL_DOMAIN
+            value:
+              _default: "zitadel-srx.wb.ru"
+
+          - name: USE_ZITADEL
+            value:
+              _default: "1"
+
+          - name: FLOWS_URL
+            value:
+              _default: "http://backend-service.flows.svc.cluster.local:8000"
+
+          - name: LAST_MASTER_BIM
+            value:
+              _default: "36311"
+
+          - name: API_ADDRESS
+            value:
+              _default: "0.0.0.0:8080"
+
+          - name: API_ADDRESS_FILE
+            value:
+              _default: "0.0.0.0:8080"
+
+          - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES
+            value:
+              _default: "5"
+
+          - name: ENABLE_SQL_QUERY
+            value:
+              _default: "0"
+
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+
+          - name: WORKSPACE_V2_EXTERNAL_URL
+            value:
+              _default: "https://srx.wb.ru/workspaces-v2/"
+
+          - name: ENABLE_S3
+            value:
+              _default: "1"
+
+          - name: CONTAINER_REGISTRY
+            value:
+              _default: "cr.yandex/crp3ccidau046kdj8g9q"
+
+          - name: ENVIRONMENT
+            value:
+              _default: "production"
+
+          - name: LAST_SLAVE_1_BIM
+            value:
+              _default: "1000000"
+
+          - name: HOST
+            value:
+              _default: "http://documentations-api.documentations.svc.cluster.local:8080"
+
+          - name: FILE_STREAM_HOST
+            value:
+              _default: "srx.wb.ru"
+
+          - name: DOCUMENTATION_URL
+            value:
+              _default: "http://documentations-api.documentations.svc.cluster.local:8080/"
+
+          - name: WORKFLOW_URL
+            value:
+              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000/"
+
+          - name: WORKSPACE_URL
+            value:
+              _default: "http://workspaces-service.workspaces.svc.cluster.local:8000/"
+
+          - name: BIM_API_URL
+            value:
+              _default: "http://bim-api-service.bim.svc.cluster.local:8080/"
+
+          - name: BIM_API_V2_URL
+            value:
+              _default: "http://backend-service.bim.svc.cluster.local:8000/"
+
+          - name: WORKSPACE_BUNDLE_VERSION
+            value:
+              _default: "v1"
+
+          - name: SYSTEM_LOG_URL
+            value:
+              _default: "http://api-service.system-log.svc.cluster.local:8000"
+
+          - name: DJANGO_HOST
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+          - name: MARKS_PROCESSING_URL
+            value:
+              _default: "http://marks-service:8000"
+
+          - name: PUBLIC_LINK_HOST
+            value:
+              _default: "https://document-link-srx.wb.ru"
+
+          - name: NAMESPACE
+            value:
+              _default: "documentations"
+
+          - name: DJANGO_ORIGINATOR
+            value:
+              _default: "docs_prod"
+
+          - name: WORKFLOW_IMAGES_VERSION
+            value:
+              _default: "master"
+
+          - name: WORKFLOWS_IMAGES_VERSION
+            value:
+              _default: "master"
+
+          - name: S3_SERVICE_ACCOUNT
+            value:
+              _default: "/etc/sarex/yc-s3-storage/yc-s3-service-account.json"
+
+          - name: READ_WRITE_TIMEOUT_FILE_STREAM
+            value:
+              _default: "6h"
+
+          - name: CACHE_DEFAULT_EXPIRATION
+            value:
+              _default: "60s"
+
+          - name: ENABLE_SMTP
+            value:
+              _default: "True"
+
+          - name: ENABLE_MAILGUN
+            value:
+              _default: "False"
+
+          - name: CACHE_CLEANUP_INTERVAL
+            value:
+              _default: "60s"
+
+          - name: ENABLE_AUTH_JWT_IN_URL
+            value:
+              _default: "false"
+
+          - name: ENABLE_SIGNATURE_IN_URL
+            value:
+              _default: "true"
+
+          - name: USE_CACHE_IN_FILE_STREAMER
+            value:
+              _default: "1"
+
+          - name: VALKEY_ADDR
+            value:
+              _default: "redis:6379"
+
+          - name: VALKEY_HOST
+            value:
+              _default: "redis"
+
+          - name: VALKEY_PORT
+            value:
+              _default: "6379"
+
+        secretEnvs:
+          - name: PUBLIC_KEY
+            secretName:
+              _default: "public-key"
+            secretKey: "key"
+
+          - name: DOCUMENT_PUBLIC_LINK_JWT_SECRET
+            secretName:
+              _default: "yc-jwt-secret"
+            secretKey: "secret"
+
+          - name: POSTGRES_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: POSTGRES_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: DJANGO_BASIC_AUTH
+            secretName:
+              _default: "django-auth"
+            secretKey: "key"
+
+          - name: DJANGO_BASIC_AUTH_FOR_GET_USER
+            secretName:
+              _default: "django-auth"
+            secretKey: "key"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/documentations/wb/filestream.yaml

@@ -0,0 +1,292 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: documentations-filestream
+  namespace: documentations
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      documentations-filestream:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:prod_3f19a21d
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: documentations-filestream
+
+          replicaCount:
+            _default: 3
+
+          port:
+            _default: 8080
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: documentations-filestream
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8080
+
+          targetPort:
+            _default: 8080
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: documentations-yc-s3-secret
+              mountPath:
+                _default: /etc/sarex/yc-s3-storage
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: documentations-yc-s3
+
+            - name: zitadel-account
+              mountPath:
+                _default: /etc/sarex/zitadel
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: zitadel-account
+
+        envs:
+          - name: POSTGRES_ADDRESS
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: POSTGRES_PORT
+            value:
+              _default: "5432"
+
+          - name: POSTGRES_DB
+            value:
+              _default: "documentations_db"
+
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "20"
+
+          - name: API_ADDRESS
+            value:
+              _default: "0.0.0.0:8080"
+
+          - name: API_ADDRESS_FILE
+            value:
+              _default: "0.0.0.0:8080"
+
+          - name: ENABLE_SQL_QUERY
+            value:
+              _default: "0"
+
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+
+          - name: ENABLE_S3
+            value:
+              _default: "1"
+
+          - name: ZITADEL_ACCOUNT
+            value:
+              _default: "/etc/sarex/zitadel/zitadel-account.json"
+
+          - name: ZITADEL_DOMAIN
+            value:
+              _default: "zitadel-srx.wb.ru"
+
+          - name: USE_ZITADEL
+            value:
+              _default: "1"
+
+          - name: CONTAINER_REGISTRY
+            value:
+              _default: "cr.yandex/crp3ccidau046kdj8g9q"
+
+          - name: ENVIRONMENT
+            value:
+              _default: "production"
+
+          - name: HOST
+            value:
+              _default: "http://documentations-service.documentations.svc.cluster.local:8080"
+
+          - name: FILE_STREAM_HOST
+            value:
+              _default: "srx.wb.ru"
+
+          - name: DOCUMENTATION_URL
+            value:
+              _default: "http://documentations-service.documentations.svc.cluster.local:8080/"
+
+          - name: WORKFLOW_URL
+            value:
+              _default: "http://workflows-service.workflow.svc.cluster.local:8000/"
+
+          - name: WORKSPACE_URL
+            value:
+              _default: "http://workspaces-service.workspaces.svc.cluster.local:8000/"
+
+          - name: BIM_API_URL
+            value:
+              _default: "http://bim-api-service.bim.svc.cluster.local:8080/"
+
+          - name: BIM_API_V2_URL
+            value:
+              _default: "http://backend-service.bim.svc.cluster.local:8000/"
+
+          - name: ENABLE_AUTH_JWT_IN_URL
+            value:
+              _default: "false"
+
+          - name: ENABLE_SIGNATURE_IN_URL
+            value:
+              _default: "true"
+
+          - name: WORKSPACE_BUNDLE_VERSION
+            value:
+              _default: "v1"
+
+          - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES
+            value:
+              _default: "5"
+
+          - name: DJANGO_HOST
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+          - name: NAMESPACE
+            value:
+              _default: "sarex-documentations"
+
+          - name: DJANGO_ORIGINATOR
+            value:
+              _default: "docs_prod"
+
+          - name: WORKFLOW_IMAGES_VERSION
+            value:
+              _default: "master"
+
+          - name: WORKFLOWS_IMAGES_VERSION
+            value:
+              _default: "master"
+
+          - name: S3_SERVICE_ACCOUNT
+            value:
+              _default: "/etc/sarex/yc-s3-storage/yc-s3-service-account.json"
+
+          - name: READ_WRITE_TIMEOUT_FILE_STREAM
+            value:
+              _default: "6h"
+
+          - name: CACHE_DEFAULT_EXPIRATION
+            value:
+              _default: "60s"
+
+          - name: CACHE_CLEANUP_INTERVAL
+            value:
+              _default: "60s"
+
+          - name: USE_CACHE_IN_FILE_STREAMER
+            value:
+              _default: "1"
+
+          - name: VALKEY_ADDR
+            value:
+              _default: "redis:6379"
+
+          - name: VALKEY_HOST
+            value:
+              _default: "redis"
+
+          - name: VALKEY_PORT
+            value:
+              _default: "6379"
+
+        secretEnvs:
+          - name: DJANGO_BASIC_AUTH_FOR_GET_USER
+            secretName:
+              _default: "django-auth"
+            secretKey: "key"
+
+          - name: DOCUMENT_PUBLIC_LINK_JWT_SECRET
+            secretName:
+              _default: "yc-jwt-secret"
+            secretKey: "secret"
+
+          - name: POSTGRES_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: POSTGRES_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: DJANGO_BASIC_AUTH
+            secretName:
+              _default: "django-auth"
+            secretKey: "key"
+
+          - name: PUBLIC_KEY
+            secretName:
+              _default: "public-key"
+            secretKey: "key"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/documentations/wb/frontend-public-link.yaml

@@ -0,0 +1,113 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend-public-link
+  namespace: documentations
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      frontend-public-link:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/document-link-frontend:wb_cb2027ce
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: frontend-public-link
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 3000
+
+          command:
+            _default: ["npm", "start"]
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: frontend-service-public-link
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 3000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: envfile
+              mountPath:
+                _default: /app/.env.local
+              subPath:
+                _default: .env.local
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: documentations-publiclink-jwt-secret
+                items:
+                  - key: .env
+                    path:
+                      _default: .env.local
+
+        envs:
+          - name: NODE_ENV
+            value:
+              _default: "production"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/documentations/wb/frontend-static.yaml

@@ -0,0 +1,88 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: documentation-frontend-static
+  namespace: documentations
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      documentation-frontend-static:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/documentation-frontend-app:brusnika_e5f99d7c
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: documentation-frontend-static
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: documentation-frontend-static-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/documentations/wb/kustomization.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: documentations
+resources:
+  - api.yaml
+  - filestream.yaml
+  - pdm-api.yaml
+  - pdf-markings.yaml
+  - pdf-markings-amqp.yaml
+  - frontend-public-link.yaml
+  - frontend-static.yaml
+  - redis.yaml
+  - stamp-verification.yaml

apps/documentations/wb/pdf-markings-amqp.yaml

@@ -0,0 +1,193 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: pdf-markings-amqp
+  namespace: documentations
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      api:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_3ab263be
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: pdf-markings-amqp
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: false
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: yc-s3
+              mountPath:
+                _default: /etc/sarex/yc-s3-storage
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: yc-s3
+
+        envs:
+          - name: MARKS_APP__LOG_LEVEL
+            value:
+              _default: "INFO"
+
+          - name: MARKS_CRYPTO__HASHING_ALGO
+            value:
+              _default: "md_gost12_256"
+
+          - name: MARKS_DOCUMENTS_DB__HOST
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: MARKS_DOCUMENTS_DB__PORT
+            value:
+              _default: "5432"
+
+          - name: MARKS_DOCUMENTS_DB__DATABASE
+            value:
+              _default: "documentations_db"
+
+          - name: MARKS_DOCUMENTS_DB__SSLMODE
+            value:
+              _default: "disable"
+
+          - name: MARKS_QR__REDIRECT_URL
+            value:
+              _default: "https://stamp-verification-srx.wb.ru/"
+
+          - name: MARKS_QR__BASE_DOCUMENT_URL
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: MARKS_S3__USE_SSL
+            value:
+              _default: "false"
+
+          - name: MARKS_S3__SSL_VERIFY
+            value:
+              _default: "false"
+
+          - name: MARKS_S3__REGION
+            value:
+              _default: "ru-central1"
+
+          - name: MARKS_S3__DEFAULT_BUCKET
+            value:
+              _default: "documentations-stage-1-sarex-new"
+
+          - name: MARKS_RABBITMQ__ROUTING__INPUT_QUEUE
+            value:
+              _default: "pdf_markings_input"
+
+        secretEnvs:
+          - name: MARKS_DOCUMENTS_DB__USERNAME
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: MARKS_DOCUMENTS_DB__PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: MARKS_S3__URL
+            secretName:
+              _default: "yc-s3"
+            secretKey: "endpoint_url"
+
+          - name: MARKS_S3__ACCESS_KEY
+            secretName:
+              _default: "yc-s3"
+            secretKey: "key_id"
+
+          - name: MARKS_S3__SECRET_KEY
+            secretName:
+              _default: "yc-s3"
+            secretKey: "access_key"
+
+          - name: MARKS_RABBITMQ__HOST
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "host"
+
+          - name: MARKS_RABBITMQ__PORT
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "port"
+
+          - name: MARKS_RABBITMQ__USERNAME
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "username"
+
+          - name: MARKS_RABBITMQ__PASSWORD
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "password"
+
+          - name: MARKS_RABBITMQ__VHOST
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "vhost"
+
+          - name: MARKS_RABBITMQ__HEARTBEAT_SECONDS
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "heartbeat"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/documentations/wb/pdf-markings.yaml

@@ -0,0 +1,231 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: pdf-markings
+  namespace: documentations
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      pdf-markings:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings:prod_7d892636
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: pdf-markings
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          resources:
+            requests:
+              cpu:
+                _default: "2"
+              memory:
+                _default: 8Gi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: marks-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: yc-s3
+              mountPath:
+                _default: /etc/sarex/yc-s3-storage
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: documentations-yc-s3
+
+        envs:
+          - name: APP_NAME
+            value:
+              _default: "pdm_v2"
+
+          - name: VERIFY
+            value:
+              _default: "False"
+
+          - name: APP_VERSION
+            value:
+              _default: "0.0.1"
+
+          - name: LOG_LEVEL
+            value:
+              _default: "INFO"
+
+          - name: HTTP_PORT
+            value:
+              _default: "8000"
+
+          - name: DOC_POSTGRES_HOST
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: DOC_POSTGRES_PORT
+            value:
+              _default: "5432"
+
+          - name: DOC_POSTGRES_DB
+            value:
+              _default: "documentations_db"
+
+          - name: DOC_POSTGRES_POOL_SIZE
+            value:
+              _default: "10"
+
+          - name: DOC_POSTGRES_SSL_MODE
+            value:
+              _default: "disable"
+
+          - name: API_ADDRESS
+            value:
+              _default: "0.0.0.0:8000"
+
+          - name: DATABASE_SSL_MODE
+            value:
+              _default: "disable"
+
+          - name: YANDEX_S3_USE_SSL
+            value:
+              _default: "0"
+
+          - name: ENVIRONMENT
+            value:
+              _default: "production"
+
+          - name: YANDEX_S3_ACCOUNT_PATH
+            value:
+              _default: "/etc/sarex/yc-s3-storage/yc-s3-service-account.json"
+
+          - name: REDIRECT_URL_QR
+            value:
+              _default: "https://stamp-verification-srx.wb.ru/"
+
+          - name: BASE_DOCUMENT_URL
+            value:
+              _default: "https://srx.wb.ru"
+
+        secretEnvs:
+          - name: DOC_POSTGRES_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: DOC_POSTGRES_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: YANDEX_S3_ENDPOINT_URL
+            secretName:
+              _default: "yc-s3"
+            secretKey: "endpoint_url"
+
+          - name: YANDEX_S3_SECRET_ACCESS_KEY
+            secretName:
+              _default: "yc-s3"
+            secretKey: "access_key"
+
+          - name: YANDEX_S3_ACCESS_KEY_ID
+            secretName:
+              _default: "yc-s3"
+            secretKey: "key_id"
+
+          - name: RABBITMQ_HOST
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "host"
+
+          - name: RABBITMQ_PORT
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "port"
+
+          - name: RABBITMQ_USERNAME
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "username"
+
+          - name: RABBITMQ_PASSWORD
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "password"
+
+          - name: RABBITMQ_VHOST
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "vhost"
+
+          - name: RABBITMQ_HEARTBEAT
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "heartbeat"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/documentations/wb/pdm-api.yaml

@@ -0,0 +1,346 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: pdm-api
+  namespace: documentations
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      pdm-api:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/pdmv2:prod_9507c2d5
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: pdm-api
+
+          replicaCount:
+            _default: 3
+
+          port:
+            _default: 8080
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: pdm-api
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8080
+
+          targetPort:
+            _default: 8080
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: documentations-yc-s3-secret
+              mountPath:
+                _default: /etc/sarex/yc-s3-storage
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: documentations-yc-s3
+
+        envs:
+          - name: USE_EXPERIMENTAL
+            value:
+              _default: "true"
+
+          - name: API_ADDRESS
+            value:
+              _default: "0.0.0.0:8080"
+
+          - name: API_ADDRESS_FILE
+            value:
+              _default: "0.0.0.0:8080"
+
+          - name: BUCKET_NAME
+            value:
+              _default: "attachments-storage"
+
+          - name: API_HOST_PREFIX
+            value:
+              _default: "/"
+
+          - name: APP_NAME
+            value:
+              _default: "pdm_v2"
+
+          - name: APP_VERSION
+            value:
+              _default: "0.0.1"
+
+          - name: ENABLE_PERMISSIONS_FILTER
+            value:
+              _default: "1"
+
+          - name: PERMISSIONS_FILTER_COMPANIES
+            value:
+              _default: "[1]"
+
+          - name: TRANSMITTALS_ENABLE
+            value:
+              _default: "false"
+
+          - name: DRAWINGS_INTERNAL_URL
+            value:
+              _default: "http://drawings-api-service.drawings.svc.cluster.local:80"
+
+          - name: ATTACHMENTS_URL
+            value:
+              _default: "http://attachments-service.attachments.svc.cluster.local:8000"
+
+          - name: BIM_API_V2_URL
+            value:
+              _default: "http://backend-service.bim.svc.cluster.local:8000/"
+          
+          - name: NOTES_URL
+            value:
+              _default: ""
+
+          - name: BIM_V2_HOST
+            value:
+              _default: "http://backend-service.bim.svc.cluster.local:8000/"
+
+          - name: CACHE_CLEANUP_INTERVAL
+            value:
+              _default: "60s"
+
+          - name: CACHE_DEFAULT_EXPIRATION
+            value:
+              _default: "60s"
+
+          - name: DJANGO_HOST
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+          - name: DJANGO_ORIGINATOR
+            value:
+              _default: "docs_prod"
+
+          - name: DOCUMENTATION_URL
+            value:
+              _default: "http://documentations-api.documentations.svc.cluster.local:8080/"
+
+          - name: EAV_URL
+            value:
+              _default: "http://eav-service.eav.svc.cluster.local:8000"
+
+          - name: ENABLE_OBSERVABILITY
+            value:
+              _default: "false"
+
+          - name: ENABLE_S3
+            value:
+              _default: "1"
+
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+
+          - name: ENVIRONMENT
+            value:
+              _default: "prod"
+
+          - name: FLOWS_URL
+            value:
+              _default: "http://backend-service.flows.svc.cluster.local:8000"
+
+          - name: HEIGHT_THUMB_ATTACHMENTS
+            value:
+              _default: "300"
+
+          - name: HEIGHT_THUMB_STATES
+            value:
+              _default: "73"
+
+          - name: HTTP_PORT
+            value:
+              _default: "8080"
+
+          - name: INSPECTIONS_URL
+            value:
+              _default: "http://inspections-service.inspections.svc.cluster.local:80"
+
+          - name: LOG_LEVEL
+            value:
+              _default: "INFO"
+
+          - name: OBSERVABILITY_COLLECTOR_ENDPOINT
+            value:
+              _default: "temp"
+
+          - name: POSTGRES_ADDRESS
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: POSTGRES_DB
+            value:
+              _default: "documentations_db"
+
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "20"
+
+          - name: TRANSMITTALS_BASE_URL
+            value:
+              _default: "mock"
+
+          - name: POSTGRES_PORT
+            value:
+              _default: "5432"
+
+          - name: READ_WRITE_TIMEOUT_FILE_STREAM
+            value:
+              _default: "6h"
+
+          - name: RELEASES_URL
+            value:
+              _default: "https://gitlab.com"
+
+          - name: REMARKS_URL
+            value:
+              _default: "http://remarks-static-service.remarks.svc.cluster.local:8080/remarks"
+
+          - name: RESOURCES_URL
+            value:
+              _default: "http://iams.iam.svc.cluster.local:8080"
+
+          - name: S3_SERVICE_ACCOUNT
+            value:
+              _default: "/etc/sarex/yc-s3-storage/yc-s3-service-account.json"
+
+          - name: STATES_URL
+            value:
+              _default: "http://workspaces-service.workspaces.svc.cluster.local:8000/"
+
+          - name: SUBSCRIPTIONS_URL
+            value:
+              _default: "http://sarex-subscriptions-service.subscriptions.svc.cluster.local:80"
+
+          - name: SYSTEM_LOG_URL
+            value:
+              _default: "http://api-service.system-log.svc.cluster.local:8000"
+
+          - name: TARGET_URL
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+          - name: USE_CACHE_IN_FILE_STREAMER
+            value:
+              _default: "1"
+
+          - name: USE_SUBSCRIPTIONS
+            value:
+              _default: "false"
+
+          - name: WIDTH_THUMB_ATTACHMENTS
+            value:
+              _default: "300"
+
+          - name: WIDTH_THUMB_STATES
+            value:
+              _default: "120"
+
+          - name: WORKFLOWS_IMAGES_VERSION
+            value:
+              _default: "master"
+
+          - name: WORKFLOW_IMAGES_VERSION
+            value:
+              _default: "master"
+
+          - name: WORKFLOW_URL
+            value:
+              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000/"
+
+          - name: WORKSPACE_BUNDLE_VERSION
+            value:
+              _default: "v1"
+
+          - name: WORKSPACE_URL
+            value:
+              _default: "http://workspaces-service.workspaces.svc.cluster.local:8000/"
+
+        secretEnvs:
+          - name: RELEASES_TOKEN
+            secretName:
+              _default: "releases-token"
+            secretKey: "key"
+
+          - name: POSTGRES_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: POSTGRES_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: DJANGO_BASIC_AUTH
+            secretName:
+              _default: "django-auth"
+            secretKey: "key"
+
+          - name: PUBLIC_KEY
+            secretName:
+              _default: "public-key"
+            secretKey: "key"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/documentations/wb/redis.yaml

@@ -0,0 +1,88 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: redis
+  namespace: documentations
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      redis:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/redis:latest
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: redis
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 6379
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: redis
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 6379
+
+          targetPort:
+            _default: 6379
+
+          portName:
+            _default: tcp
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/documentations/wb/stamp-verification.yaml

@@ -0,0 +1,90 @@
+---
+# stamp-verification — отдельное приложение (apps/stamp-verification),
+# в wb развёрнуто в ns documentations, а не в своём собственном неймспейсе.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: stamp-verification
+  namespace: documentations
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      stamp-verification:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/stamp-verification-frontend:e11a8f90be462fc325ff99c8c35a8a418815c27b
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: stamp-verification
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8080
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: stamp-verification-frontend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8080
+
+          targetPort:
+            _default: 8080
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/drawings/wb/backend.yaml

@@ -0,0 +1,120 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: drawings-api
+  namespace: drawings
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      drawings-api:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/drawings-api:015e68e1b2a3dcc13f0b405e1f761b154a825d24
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: drawings-api
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8080
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: drawings-api-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 8080
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        envs:
+          - name: POSTGRES_ADDRESS
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru:5432"
+
+          - name: POSTGRES_DB
+            value:
+              _default: "drawings_db"
+
+          - name: POSTGRES_POOL_SIZE
+            value:
+              _default: "3"
+
+          - name: API_ADDRESS
+            value:
+              _default: "0.0.0.0:8080"
+
+          - name: ENABLE_SSL
+            value:
+              _default: "0"
+
+        secretEnvs:
+          - name: POSTGRES_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: POSTGRES_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/drawings/wb/kustomization.yaml

@@ -1,5 +1,6 @@
+---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+namespace: drawings
 resources:
-- gotk-components.yaml
+  - backend.yaml
-- gotk-sync.yaml

apps/eav/base/helmrelease.yaml

@@ -93,7 +93,7 @@ spec:
                 _default: 6
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/eav:prod_0fb73247
+            _default: cr.yandex/crp3ccidau046kdj8g9q/eav:prod_0dcebba6
           pullPolicy:
             _default: IfNotPresent
         service:

apps/eav/wb/backend.yaml

@@ -0,0 +1,191 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: eav
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      backend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/eav:prod_0dcebba6
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: backend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: eav-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: django-configmap
+              mountPath:
+                _default: /server/config/settings/production.py
+              subPath:
+                _default: production.py
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: django-configmap
+                items:
+                  - key: production.py
+                    path:
+                      _default: production.py
+
+            - name: kafka-cert-volume
+              mountPath:
+                _default: /usr/local/share/ca-certificates
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: kafka-cert
+
+        envs:
+          - name: KAFKA_USERNAME
+            value:
+              _default: "sarex"
+
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: "/usr/local/share/ca-certificates/kafka.crt"
+
+          - name: KAFKA_HOST
+            value:
+              _default: "wb-stage-kafka-bootstrap.kafka.svc.cluster.local:9093"
+
+          - name: KAFKA_ENABLED
+            value:
+              _default: "False"
+
+          - name: ASSETS_TOPIC
+            value:
+              _default: "sarex"
+
+          - name: DJANGO_SETTINGS_MODULE
+            value:
+              _default: "config.settings.production"
+
+          - name: DJANGO_POSTGRES_HOST
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: DJANGO_POSTGRES_DATABASE
+            value:
+              _default: "eav_db"
+
+          - name: YC_S3_ENDPOINT_URL
+            value:
+              _default: "http://minio-svc.minio.svc.cluster.local:9000"
+
+          - name: YC_S3_BUCKET_NAME
+            value:
+              _default: "eav"
+
+        secretEnvs:
+          - name: KAFKA_PASSWORD
+            secretName:
+              _default: "kafka-cred"
+            secretKey: "password"
+
+          - name: DJANGO_POSTGRES_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: DJANGO_POSTGRES_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: JWT_PRIVATE_KEY
+            secretName:
+              _default: "backend-secret"
+            secretKey: "ssh_private.key"
+
+          - name: JWT_PUBLIC_KEY
+            secretName:
+              _default: "backend-secret"
+            secretKey: "ssh_public.key"
+
+          - name: YC_S3_ACCESS_KEY_ID
+            secretName:
+              _default: "s3-secret"
+            secretKey: "login"
+
+          - name: YC_S3_SECRET_ACCESS_KEY
+            secretName:
+              _default: "s3-secret"
+            secretKey: "password"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/eav/wb/django-configmap.yaml

@@ -0,0 +1,147 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: django-configmap
+  namespace: eav
+data:
+  production.py: |
+    # production.py
+
+    from .base import *
+    from datetime import timedelta
+    import os
+    from django.core.exceptions import ImproperlyConfigured
+
+    INSTALLED_APPS.append("corsheaders")
+    #MIDDLEWARE = ["corsheaders.middleware.CorsMiddleware"] + MIDDLEWARE
+
+    # DEBUG SETTINGS START
+    # ---------------------------------------------------------------------------------------------------------------------
+    DEBUG = True
+    ALLOWED_HOSTS = ['*']
+    # ---------------------------------------------------------------------------------------------------------------------
+    # DEBUG SETTINGS END
+
+    # DATABASE SETTINGS START
+    # ---------------------------------------------------------------------------------------------------------------------
+    DATABASES = {
+        "default": {
+            "ENGINE": "django.db.backends.postgresql",
+            "NAME": os.getenv("DJANGO_POSTGRES_DATABASE"),
+            "USER": os.getenv("DJANGO_POSTGRES_USER"),
+            "PASSWORD": os.getenv("DJANGO_POSTGRES_PASSWORD"),
+            "HOST": os.getenv("DJANGO_POSTGRES_HOST"),
+            "PORT": "5432",
+        }
+    }
+    # ---------------------------------------------------------------------------------------------------------------------
+    # DATABASE SETTINGS END
+
+    # RESPONSE HEADERS START
+    # ---------------------------------------------------------------------------------------------------------------------
+    CORS_ORIGIN_ALLOW_ALL = True
+
+    CORS_ALLOWED_ORIGINS = [
+        "https://srx.wb.ru",
+    ]
+
+    CORS_TRUSTED_ORIGINS = [
+        "https://srx.wb.ru",
+    ]
+
+    CSRF_TRUSTED_ORIGINS = [
+        "https://srx.wb.ru",
+    ]
+
+    CORS_ALLOW_METHODS = (
+        'DELETE',
+        'GET',
+        'OPTIONS',
+        'PATCH',
+        'POST',
+        'PUT',
+    )
+
+    CORS_ALLOW_HEADERS = (
+        'accept',
+        'accept-encoding',
+        'authorization',
+        'content-type',
+        'user-agent',
+        'x-csrftoken',
+        'x-requested-with',
+        'x-token',
+        'Bearer'
+    )
+    # ---------------------------------------------------------------------------------------------------------------------
+    # RESPONSE HEADERS END
+
+    REST_FRAMEWORK = {
+        "DEFAULT_PAGINATION_CLASS": (
+            "rest_framework.pagination.LimitOffsetPagination"
+        ),
+        "DEFAULT_SCHEMA_CLASS": "rest_framework.schemas.coreapi.AutoSchema",
+        "PAGE_SIZE": 10000,
+        "DEFAULT_FILTER_BACKENDS": [
+            "django_filters.rest_framework.DjangoFilterBackend"
+        ],
+        "DEFAULT_AUTHENTICATION_CLASSES": [
+            "core.auth.ZitadelJWTAuthentication",
+            "rest_framework_simplejwt.authentication.JWTAuthentication",
+            "rest_framework.authentication.SessionAuthentication",
+            "rest_framework.authentication.BasicAuthentication",
+        ],
+        "DEFAULT_PERMISSION_CLASSES": [
+            "rest_framework.permissions.AllowAny",
+        ]
+    }
+
+    # JWT SETTINGS START
+    # ---------------------------------------------------------------------------------------------------------------------
+    def get_env_variable(var_name, default=None):
+        try:
+            return os.getenv(var_name, default)
+        except KeyError:
+            error_msg = f"Set the {var_name} environment variable"
+            if default:
+                return default
+            raise ImproperlyConfigured(error_msg)
+
+    SIMPLE_JWT_ISSUER = get_env_variable("SIMPLE_JWT_ISSUER", default="django")
+
+    SIMPLE_JWT = {
+        "ACCESS_TOKEN_LIFETIME": timedelta(minutes=5),
+        "REFRESH_TOKEN_LIFETIME": timedelta(days=1),
+        "ROTATE_REFRESH_TOKENS": False,
+        "UPDATE_LAST_LOGIN": False,
+
+        "ALGORITHM": "RS512",
+        "SIGNING_KEY": get_env_variable("JWT_PRIVATE_KEY").replace("\\\n", "\n"),
+        "VERIFYING_KEY": get_env_variable("JWT_PUBLIC_KEY").replace("\\\n", "\n"),
+        "AUDIENCE": None,
+        "ISSUER": SIMPLE_JWT_ISSUER,
+
+        "AUTH_HEADER_TYPES": ("Bearer",),
+        "AUTH_HEADER_NAME": "HTTP_AUTHORIZATION",
+        "USER_ID_FIELD": "id",
+        "USER_ID_CLAIM": "user_id",
+
+        "AUTH_TOKEN_CLASSES": ("rest_framework_simplejwt.tokens.AccessToken",),
+        "TOKEN_TYPE_CLAIM": "token_type",
+
+        "JTI_CLAIM": "jti",
+
+        "SLIDING_TOKEN_REFRESH_EXP_CLAIM": "refresh_exp",
+        "SLIDING_TOKEN_LIFETIME": timedelta(minutes=5),
+        "SLIDING_TOKEN_REFRESH_LIFETIME": timedelta(days=1),
+    }
+    # ---------------------------------------------------------------------------------------------------------------------
+    # JWT SETTINGS END
+
+    STATIC_ROOT = '/static/'
+    STATIC_URL = '/static/'
+    STATICFILES_STORAGE = 'django.contrib.staticfiles.storage.StaticFilesStorage'
+
+    SESSION_COOKIE_NAME = 'eav-sessionid'
+    CSRF_COOKIE_NAME = 'eav-csrftoken'

apps/eav/wb/kafka-cert-configmap.yaml

@@ -0,0 +1,38 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kafka-cert
+  namespace: eav
+data:
+  kafka.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIIFLTCCAxWgAwIBAgIUA5L48eHPMqNFYE5wIgaOmWgG3okwDQYJKoZIhvcNAQEN
+    BQAwLTETMBEGA1UECgwKaW8uc3RyaW16aTEWMBQGA1UEAwwNY2x1c3Rlci1jYSB2
+    MDAeFw0yNTA2MDQxMTMzMTRaFw0yNjA2MDQxMTMzMTRaMC0xEzARBgNVBAoMCmlv
+    LnN0cmltemkxFjAUBgNVBAMMDWNsdXN0ZXItY2EgdjAwggIiMA0GCSqGSIb3DQEB
+    AQUAA4ICDwAwggIKAoICAQDV2NBVwnXISH9i8K4KxSd2AThwgQyRKyeIfcqeYZ4F
+    7FguEUI7uEtoWd4uO8DsIzoMoLYv5L1DfhNYUFWN3XYQd4XVFnwYQYbwspdC1L8G
+    u0T7943gRRRomcNP8n5nycfeZgZgmz9IS8vmxgRh4ao0kcCW49uBQMd706087UAI
+    qaRJTcabTZq1LTeoH9AOAyT/nawKm+1H5VmrMUBjzz9xKVXF0sCrhjYoZoM4x+fY
+    AphtxZDB21ZhEcHBbytEQkEm0QTbUP4xbu95yqY6goYi9S9R1uMgVZ9DoJVwyqLm
+    /3ZGPjd9VmdBPO/zE/Bj890DjyKS7AXo9d+Iyv4M2QD1jA+5j4JyHzk7Lroz+HTg
+    mwVpcVGafBWIC4qFt7C3UYt6IV64/MA2v9gxTIdJvOBZxKUiMl7f65jKNEntF6is
+    86QCkjhvt34AThEoGx8SPjVr3sOBuneqcybeSYLyEWFg9Z1mWfMLHlA/Fp/Y2wpM
+    w1ZXj6uAa/UNUAIfkaLTOKHHaCCVD2G3Vkm94NHOJmDj6ze8P0J0H+Ub6ULD7hHr
+    8obOSk9OvxoxVzE+UW7DyEL6YD8MBVUQKJIQVgZmpT4akWyz8bNhFRzgTnKAhwNN
+    ATrGmjfX/wj7tCpy/PoJjEiu54sXW5xplBIz/ZgYHrPkyrbhQxsRozgQ+UIMIIbJ
+    /wIDAQABo0UwQzAdBgNVHQ4EFgQUkU4HKndgWxhcXMAe5XBc4OJwSgcwEgYDVR0T
+    AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQENBQADggIB
+    AFLi5QLawZollou3+m5kYcBe5F8xKG5NlgNmKyIREnwD2AP4xrr2tNFbmP2hpEl4
+    bWJJ84IHlKjpYxFLboWzgtW/JvdxcEh0K/x8/7cOD3Kk9d/LR9muj57mFYSQGlbo
+    g0+lHNuLam8xGcnGVV5VdfcjFz72/q92ndTlJmz+v6OneTJvIypKoBmNKF25alz9
+    pR2sTwoG0Pcwm30u/uS6pOewQ4sTiniOcc1MFYF7tl/Zz9Mqza8Rer0B5nm8lE/J
+    Yo9UaEXyVLM8Y5kSOkxMlOK+8/UMeY/lcQYpd5tYVpvarnoPCjmUjt4iVw26ZsAH
+    y4/vNW+wX+Uauarik1jHL/SauAjS3FbJoH06BBnji7J/Rud2DtSd+vVZrIBLJkaH
+    +Xg/roD3xKx0XmhLJmPvxGrkyehbhkbJkPKCHa9P56rnev3MYjyy+SV7Vp8Dq+HF
+    Wkswl3QUPWx9reuvF2KMyt04Tw94UAxCUGkX5qg7Dq5d0Fj/AcIrFdLTCV8eG/UI
+    1kKRxmZ2/ALINBOlfJOVVovKBlWpPACs8iy6XreOXtoQfzoG2F9Vo3Jmzjpqsmz0
+    9Ao4s2vcz3UuDtBhpwGp4N3zroyst/kQjtZirj4cS7fu75tB5N5mQ/tTwg0Tiw+Y
+    XIdxeE73V5DAf4Dd5V1VdCbA6oQv5qJYvinYydyx4x3V
+    -----END CERTIFICATE-----

apps/eav/wb/kustomization.yaml

@@ -0,0 +1,8 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: eav
+resources:
+  - django-configmap.yaml
+  - kafka-cert-configmap.yaml
+  - backend.yaml

apps/faas/wb/backend.yaml

@@ -0,0 +1,145 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: export-reviews
+  namespace: faas
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      export-reviews:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/export-reviews:prod_c4cae4ee
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: export-reviews
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: export-reviews-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        envs:
+          - name: BASE_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: DJANGO_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: REVIEWS_HOST
+            value:
+              _default: "https://srx.wb.ru/flows"
+
+          - name: GATEWAY_HOST
+            value:
+              _default: "https://srx.wb.ru/gateway"
+
+          - name: DOCUMENTATIONS_HOST
+            value:
+              _default: "https://srx.wb.ru/documentations"
+
+          - name: EAV_HOST
+            value:
+              _default: "http://eav-service.eav.svc.cluster.local:8000"
+
+          - name: TRANSMITTALS_INTERNAL_HOST
+            value:
+              _default: "http://transmittal-service.transmittal.svc.cluster.local:80/internal/v1"
+
+          - name: DJANGO_TIMEOUT
+            value:
+              _default: "180"
+
+          - name: REVIEWS_TIMEOUT
+            value:
+              _default: "180"
+
+          - name: GATEWAY_TIMEOUT
+            value:
+              _default: "60"
+
+          - name: DOCUMENTATIONS_TIMEOUT
+            value:
+              _default: "60"
+
+          - name: EAV_TIMEOUT
+            value:
+              _default: "30"
+
+          - name: TRANSMITTALS_TIMEOUT
+            value:
+              _default: "30"
+
+          - name: TIMEOUT
+            value:
+              _default: "180"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/faas/wb/kustomization.yaml

@@ -1,5 +1,6 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+namespace: faas
 resources:
-  - ../base
+  - backend.yaml

apps/flows/wb/authentication-configmap.yaml

@@ -0,0 +1,93 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: authentication
+  namespace: flows
+data:
+  authentication.py: |
+    import httpx
+
+    from fastapi import Request, status
+    from itsdangerous import URLSafeTimedSerializer, BadData as BadDataError
+    from sqladmin.authentication import AuthenticationBackend
+
+    from flow.config import settings
+
+
+    class AdminAuthentication(AuthenticationBackend):
+        def get_serializer(self) -> URLSafeTimedSerializer:
+            return URLSafeTimedSerializer(
+                secret_key=settings.admin_panel.secret_key,
+            )
+
+        async def login(self, request: Request) -> bool:
+            form = await request.form()
+            username, password = form["username"], form["password"]
+            token_payload = {
+                    'is_django_user': False,
+                    'user_id': None,
+                }
+            # получаем данные о юзере
+            if True:
+                #print("OK"*30)
+                # client: httpx.AsyncClient = settings.django.get_async_session(token=settings.django.token)
+                # async with client as session:
+                #     auth_response = await session.post(url='/login/', json={
+                #         'username': username,
+                #         'password': password,
+                #     }, follow_redirects=False)
+                #     print("*"*30, auth_response.status_code ,settings.django.host, username, password,"*"*30)
+                #     if auth_response.status_code != status.HTTP_200_OK:
+                #         return False
+
+                    # django_response = await session.get(url='/client/settings/')
+                    # print("$"*30, django_response.status_code, "$"*30)
+                    # if django_response.status_code != status.HTTP_200_OK:
+                    #     return False
+                    if username == "68Lvh2PsHd5y" and password == "Hnzvh2PsHd5yI1v":
+                        #user = django_response.json()
+                        has_access = True
+                        if not has_access:
+                            return False
+
+                        user_id = 2
+
+                        token_payload = {
+                            'is_django_user': True,
+                            'user_id': user_id,
+                        }
+            else:
+                token_payload = {
+                    'is_django_user': False,
+                    'user_id': None,
+                }
+
+            token = self.get_serializer().dumps(token_payload)
+
+            request.session.update({"token": token})
+            return True
+
+        async def logout(self, request: Request) -> bool:
+            request.session.clear()
+            return True
+
+        async def authenticate(self, request: Request) -> bool:
+            token = request.session.get("token")
+
+            if not token:
+                return False
+
+            try:
+                payload = self.get_serializer().loads(token, max_age=settings.admin_panel.token_max_age)
+            except (BadDataError, KeyError):
+                return False
+
+            is_django_user = payload.get('is_django_user')
+            if settings.django.use != is_django_user:
+                return False
+
+            return True
+
+
+    authentication_backend = AdminAuthentication(secret_key=settings.admin_panel.secret_key)

apps/flows/wb/backend.yaml

@@ -0,0 +1,357 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: flows
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      backend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_a7dc8216
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: backend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: backend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: authentication
+              mountPath:
+                _default: /opt/src/flow/admin/authentication.py
+              subPath:
+                _default: authentication.py
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: authentication
+                items:
+                  - key: authentication.py
+                    path:
+                      _default: authentication.py
+
+            - name: kafka-configmap
+              mountPath:
+                _default: /opt/src/flow/kafka.py
+              subPath:
+                _default: kafka.py
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: kafka-configmap
+                items:
+                  - key: kafka.py
+                    path:
+                      _default: kafka.py
+
+        envs:
+          - name: KAFKA_HOST
+            value:
+              _default: "wb-prod-kafka-bootstrap.kafka.svc.cluster.local:9093"
+
+          - name: KAFKA_SSL_CERT
+            value:
+              _default: |
+                -----BEGIN CERTIFICATE-----
+                MIIFLTCCAxWgAwIBAgIUYDZPxGRsr7IiqHEmfd07QTQlOKYwDQYJKoZIhvcNAQEN
+                BQAwLTETMBEGA1UECgwKaW8uc3RyaW16aTEWMBQGA1UEAwwNY2x1c3Rlci1jYSB2
+                MDAeFw0yNTEyMTYxNDM0NTVaFw0yNjEyMTYxNDM0NTVaMC0xEzARBgNVBAoMCmlv
+                LnN0cmltemkxFjAUBgNVBAMMDWNsdXN0ZXItY2EgdjAwggIiMA0GCSqGSIb3DQEB
+                AQUAA4ICDwAwggIKAoICAQCfzDZhEzw2pbU5Xpu8OzD+3iQG+DVjU8PQWWQEF27h
+                yjohDkUr3zCZtW7xMKWKUNxBgrKsfe4TDOQN8cij3cS9sy0So+UhMeF7Bq9PU1Yd
+                bmTRq8q1PiuNUkiCGJ5wrb3+NZvVxZLJUIFgiealsRw80MgMWWSzy0I35T2Edn/a
+                DU4jhlgQxyzQ621+oGP0n28gCjmm6pCq2tkj/Z8WTdu1gOWyRdK02a2uE2Ts2nLa
+                Di32GaZrIbIuD/WUd6Ek66uCeJvh2CT7s+SqgtMbtT7gibUuPQ3hk1VGQsjy22l3
+                hUNpLu86nrwbuf21mY55KnLOcaVq1ag1TpIIKfZAL/KWFCGZ6H6kwEIbCAL0Hei7
+                cJ2Wm2/qlzKUeU869M7YybZAfXl/t6XT4QgFgje+42N980vy5A4GhWi1Z7lPqqOe
+                jPGBstkRZybKz1sTk87+oJx82iQU/ozVmzjSEK1SoYRNbvug8PNpxmPoPnJ2flgG
+                t2q2+2ZQP3f1aAHVcZ3U5+hWlRmKPXzjrJv7gnhuvqJl7OwB50y+yWiVfZ9xrYl2
+                EpX+yHuFFK+9NnB5taUK8Fz+hQaLU8J4q7P0bRqkoI+LdcEErjuDT/eI2d5+Ql8K
+                /JkV823hX2WNB9bdaQ24BelVUbsxGpR7ms6KWrM11kHnbzUlEM+AxZES6F7Qbr55
+                TwIDAQABo0UwQzAdBgNVHQ4EFgQUM7hshx7e9TFEN82Pf446aBrJUA4wEgYDVR0T
+                AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQENBQADggIB
+                AFNHFGPDxY966fz0dxDFFSfeo47y7XQZMK9xAwH73cQoSeqx+IMxzgM8nfJQ9XMN
+                PeLwVRZ7pvRee2ZhUPglBSTHnW2rvfmLBOO9xyKZxRsCkoFxuHH9xfM7bFWb96R6
+                fGrOdEZDB3yj00T+tkubwqt+/dUhQUj8juwyPs55WMb/0BIbapaoQ6QOP13CaXDV
+                ZmAfsEEIBkNxfq7GTr/z0Rq0B4+9FxAf3Jrsmi/dYoFD/prHsvBDkYw1daoFyp5C
+                tbctvB9wtphnCCynekt8UBvpVKHUU/xaUa09TQTToXjBbV1SZeIOHNG0MNbWa4sz
+                AL/cpXdq1EAxiTeAVT9XhCwhe/xJvFZIWuFLmW3J+ZxrOUCKieCYpTqBY2tBkkDY
+                //egic787yTR6zxqQNSzvNU5LhzrN7lu+KHGM06T35+HvpzgPPiRCzsxO62p63op
+                mq04K31yYZgLiqeAj5W+rioRGJNn4TXJpH9KIrzmGM7lVWLYWMAKeZU4r1lDUdcu
+                7jsBH8BRJWJeVK3xVw2HB3lk7Xn0WrR92adeYQ3f0vKbMIAVUnSJ3yCKJ4NMFSki
+                j78nx2mi/G0RhUPGZ9hhLXQKj9BtbpEnwpbGWtf0ShtVOxD/HKLCr7koBtW9TMPS
+                9K0sJhE5VjsQLkDDu9p3GdRcuLNA/oa7xFvRFtqGFsLj
+                -----END CERTIFICATE-----
+
+          - name: LOG_LEVEL
+            value:
+              _default: "DEBUG"
+
+          - name: BASE_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: CELERY_QUEUE
+            value:
+              _default: "flow"
+
+          - name: EAV_HOST
+            value:
+              _default: "http://eav-service.eav.svc.cluster.local:8000"
+
+          - name: DJANGO_HOST
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000/api"
+
+          - name: PLANNING_HOST
+            value:
+              _default: "http://backend-service.pm.svc.cluster.local:8000/api/pm/msp"
+
+          - name: PLANNING_USE
+            value:
+              _default: "True"
+
+          - name: DOCUMENTATION_HOST
+            value:
+              _default: "http://documentations-api.documentations.svc.cluster.local:8080/internal/v1"
+
+          - name: DOCUMENTATION_EXTERNAL_HOST
+            value:
+              _default: "http://documentations-api.documentations.svc.cluster.local:8080/api/v1"
+
+          - name: ENABLE_ANALYTICS
+            value:
+              _default: "1"
+
+          - name: ENABLE_CELERY
+            value:
+              _default: "1"
+
+          - name: ENABLE_MAILGUN
+            value:
+              _default: "0"
+
+          - name: ENABLE_METRICS
+            value:
+              _default: "0"
+
+          - name: FROM_EMAIL
+            value:
+              _default: "sarex@rwb.ru"
+
+          - name: GATEWAY_URL
+            value:
+              _default: "http://pdm-api.documentations.svc.cluster.local:8080"
+
+          - name: PG_HOST
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: PG_PORT
+            value:
+              _default: "5432"
+
+          - name: RABBITMQ_HOST
+            value:
+              _default: "rabbitmq.rabbitmq.svc.cluster.local"
+
+          - name: RABBITMQ_PORT
+            value:
+              _default: "5672"
+
+          - name: RESOURCE_URL
+            value:
+              _default: "http://iams.iam.svc.cluster.local:8080"
+
+          - name: SERVICE_HOST
+            value:
+              _default: "https://srx.wb.ru/flows/api/v1"
+
+          - name: SMTP_HOST
+            value:
+              _default: "mail.rwb.ru"
+
+          - name: DOCUMENTATION_PG_PORT
+            value:
+              _default: "5432"
+
+          - name: PROXY_PATH_PREFIX
+            value:
+              _default: "/flows"
+
+          - name: DOCUMENTATION_PG_DATABASE
+            value:
+              _default: "documentations_db"
+
+          - name: DOCUMENTATION_PG_HOST
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: CHECKLIST_HOST
+            value:
+              _default: "http://checklists-backend-service.checklists.svc.cluster.local:80"
+
+          - name: SMTP_PORT
+            value:
+              _default: "465"
+
+          - name: SYNC_RESOURCE_ID
+            value:
+              _default: "1"
+
+          - name: TIMEOUT
+            value:
+              _default: "120"
+
+          - name: WORKFLOWS_HOST
+            value:
+              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000/api/v1"
+
+          - name: WORKFLOWS_TIMEOUT
+            value:
+              _default: "60"
+
+          - name: DOCUMENTATION_TIMEOUT
+            value:
+              _default: "60"
+
+        secretEnvs:
+          - name: ADMIN_PANEL_SECRET_KEY
+            secretName:
+              _default: "admin-secret"
+            secretKey: "key"
+
+          - name: JWT_PUBLIC_KEY
+            secretName:
+              _default: "jwt-secret"
+            secretKey: "public_key"
+
+          - name: DOCUMENTATION_PG_USERNAME
+            secretName:
+              _default: "postgres-secret-documentations"
+            secretKey: "username"
+
+          - name: DOCUMENTATION_PG_PASSWORD
+            secretName:
+              _default: "postgres-secret-documentations"
+            secretKey: "password"
+
+          - name: DJANGO_TOKEN
+            secretName:
+              _default: "django-secret"
+            secretKey: "token"
+
+          - name: PG_DB
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "database"
+
+          - name: PG_LOGIN
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: PG_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: RABBITMQ_USERNAME
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "username"
+
+          - name: RABBITMQ_PASSWORD
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "password"
+
+          - name: RABBITMQ_VHOST
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "vhost"
+
+          - name: KAFKA_USERNAME
+            secretName:
+              _default: "kafka-secret"
+            secretKey: "username"
+
+          - name: KAFKA_PASSWORD
+            secretName:
+              _default: "kafka-secret"
+            secretKey: "password"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/flows/wb/celery.yaml

@@ -0,0 +1,373 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: celery
+  namespace: flows
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      celery:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_a7dc8216
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: celery
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          command:
+            _default: ["celery", "-A", "src.worker", "worker", "-l", "INFO", "-E", "--concurrency=1", "-Q", "flow"]
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: false
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: kafka-configmap
+              mountPath:
+                _default: /opt/src/flow/kafka.py
+              subPath:
+                _default: kafka.py
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: kafka-configmap
+                items:
+                  - key: kafka.py
+                    path:
+                      _default: kafka.py
+
+        envs:
+          - name: KAFKA_HOST
+            value:
+              _default: "wb-prod-kafka-bootstrap.kafka.svc.cluster.local:9093"
+
+          - name: KAFKA_SSL_CERT
+            value:
+              _default: |
+                -----BEGIN CERTIFICATE-----
+                MIIFLTCCAxWgAwIBAgIUYDZPxGRsr7IiqHEmfd07QTQlOKYwDQYJKoZIhvcNAQEN
+                BQAwLTETMBEGA1UECgwKaW8uc3RyaW16aTEWMBQGA1UEAwwNY2x1c3Rlci1jYSB2
+                MDAeFw0yNTEyMTYxNDM0NTVaFw0yNjEyMTYxNDM0NTVaMC0xEzARBgNVBAoMCmlv
+                LnN0cmltemkxFjAUBgNVBAMMDWNsdXN0ZXItY2EgdjAwggIiMA0GCSqGSIb3DQEB
+                AQUAA4ICDwAwggIKAoICAQCfzDZhEzw2pbU5Xpu8OzD+3iQG+DVjU8PQWWQEF27h
+                yjohDkUr3zCZtW7xMKWKUNxBgrKsfe4TDOQN8cij3cS9sy0So+UhMeF7Bq9PU1Yd
+                bmTRq8q1PiuNUkiCGJ5wrb3+NZvVxZLJUIFgiealsRw80MgMWWSzy0I35T2Edn/a
+                DU4jhlgQxyzQ621+oGP0n28gCjmm6pCq2tkj/Z8WTdu1gOWyRdK02a2uE2Ts2nLa
+                Di32GaZrIbIuD/WUd6Ek66uCeJvh2CT7s+SqgtMbtT7gibUuPQ3hk1VGQsjy22l3
+                hUNpLu86nrwbuf21mY55KnLOcaVq1ag1TpIIKfZAL/KWFCGZ6H6kwEIbCAL0Hei7
+                cJ2Wm2/qlzKUeU869M7YybZAfXl/t6XT4QgFgje+42N980vy5A4GhWi1Z7lPqqOe
+                jPGBstkRZybKz1sTk87+oJx82iQU/ozVmzjSEK1SoYRNbvug8PNpxmPoPnJ2flgG
+                t2q2+2ZQP3f1aAHVcZ3U5+hWlRmKPXzjrJv7gnhuvqJl7OwB50y+yWiVfZ9xrYl2
+                EpX+yHuFFK+9NnB5taUK8Fz+hQaLU8J4q7P0bRqkoI+LdcEErjuDT/eI2d5+Ql8K
+                /JkV823hX2WNB9bdaQ24BelVUbsxGpR7ms6KWrM11kHnbzUlEM+AxZES6F7Qbr55
+                TwIDAQABo0UwQzAdBgNVHQ4EFgQUM7hshx7e9TFEN82Pf446aBrJUA4wEgYDVR0T
+                AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQENBQADggIB
+                AFNHFGPDxY966fz0dxDFFSfeo47y7XQZMK9xAwH73cQoSeqx+IMxzgM8nfJQ9XMN
+                PeLwVRZ7pvRee2ZhUPglBSTHnW2rvfmLBOO9xyKZxRsCkoFxuHH9xfM7bFWb96R6
+                fGrOdEZDB3yj00T+tkubwqt+/dUhQUj8juwyPs55WMb/0BIbapaoQ6QOP13CaXDV
+                ZmAfsEEIBkNxfq7GTr/z0Rq0B4+9FxAf3Jrsmi/dYoFD/prHsvBDkYw1daoFyp5C
+                tbctvB9wtphnCCynekt8UBvpVKHUU/xaUa09TQTToXjBbV1SZeIOHNG0MNbWa4sz
+                AL/cpXdq1EAxiTeAVT9XhCwhe/xJvFZIWuFLmW3J+ZxrOUCKieCYpTqBY2tBkkDY
+                //egic787yTR6zxqQNSzvNU5LhzrN7lu+KHGM06T35+HvpzgPPiRCzsxO62p63op
+                mq04K31yYZgLiqeAj5W+rioRGJNn4TXJpH9KIrzmGM7lVWLYWMAKeZU4r1lDUdcu
+                7jsBH8BRJWJeVK3xVw2HB3lk7Xn0WrR92adeYQ3f0vKbMIAVUnSJ3yCKJ4NMFSki
+                j78nx2mi/G0RhUPGZ9hhLXQKj9BtbpEnwpbGWtf0ShtVOxD/HKLCr7koBtW9TMPS
+                9K0sJhE5VjsQLkDDu9p3GdRcuLNA/oa7xFvRFtqGFsLj
+                -----END CERTIFICATE-----
+
+          - name: LOG_LEVEL
+            value:
+              _default: "DEBUG"
+
+          - name: FLOWS_HOST
+            value:
+              _default: "http://backend-service.flows.svc.cluster.local:8000"
+
+          - name: DOCUMENTATION_PG_PORT
+            value:
+              _default: "5432"
+
+          - name: DOCUMENTATION_PG_DATABASE
+            value:
+              _default: "documentations_db"
+
+          - name: DOCUMENTATION_PG_HOST
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: BASE_HOST
+            value:
+              _default: "https://lk.srx.wb.ru:30443"
+
+          - name: CELERY_QUEUE
+            value:
+              _default: "flow"
+
+          - name: RESOURCES_HOST
+            value:
+              _default: "http://resources-service.resources.svc.cluster.local:8000/"
+
+          - name: DJANGO_HOST
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000/api"
+
+          - name: DOCUMENTATION_HOST
+            value:
+              _default: "http://documentations-api.documentations.svc.cluster.local:8080/internal/v1"
+
+          - name: DOCUMENTATION_EXTERNAL_HOST
+            value:
+              _default: "http://documentations-api.documentations.svc.cluster.local:8080/api/v1"
+
+          - name: ENABLE_ANALYTICS
+            value:
+              _default: "1"
+
+          - name: FLOWS_DB_HOST
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: FLOWS_DB_PORT
+            value:
+              _default: "5432"
+
+          - name: ISSUES_DB_PORT
+            value:
+              _default: "5432"
+
+          - name: ISSUES_DB_HOST
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: ENABLE_CELERY
+            value:
+              _default: "1"
+
+          - name: ENABLE_MAILGUN
+            value:
+              _default: "0"
+
+          - name: ENABLE_METRICS
+            value:
+              _default: "0"
+
+          - name: FROM_EMAIL
+            value:
+              _default: "wb@wb.ru"
+
+          - name: GATEWAY_URL
+            value:
+              _default: "http://pdm-api.documentations.svc.cluster.local:8080"
+
+          - name: PG_HOST
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: PG_PORT
+            value:
+              _default: "5432"
+
+          - name: RABBITMQ_HOST
+            value:
+              _default: "rabbitmq.rabbitmq.svc.cluster.local"
+
+          - name: RABBITMQ_PORT
+            value:
+              _default: "5672"
+
+          - name: DJANGO_BASE_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: RESOURCE_URL
+            value:
+              _default: "http://resources-service.resources.svc.cluster.local:8000"
+
+          - name: SERVICE_HOST
+            value:
+              _default: "https://lk.srx.wb.ru:30443/flows/api/v1"
+
+          - name: SMTP_HOST
+            value:
+              _default: "smtp-relay.wb.com"
+
+          - name: SMTP_PORT
+            value:
+              _default: "587"
+
+          - name: SYNC_RESOURCE_ID
+            value:
+              _default: "1"
+
+          - name: TIMEOUT
+            value:
+              _default: "120"
+
+          - name: WORKFLOWS_HOST
+            value:
+              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000/api/v1"
+
+          - name: WORKFLOWS_TIMEOUT
+            value:
+              _default: "60"
+
+          - name: DOCUMENTATION_TIMEOUT
+            value:
+              _default: "60"
+
+        secretEnvs:
+          - name: ADMIN_PANEL_SECRET_KEY
+            secretName:
+              _default: "admin-secret"
+            secretKey: "key"
+
+          - name: JWT_PUBLIC_KEY
+            secretName:
+              _default: "jwt-secret"
+            secretKey: "public_key"
+
+          - name: DOCUMENTATION_PG_USERNAME
+            secretName:
+              _default: "postgres-secret-documentations"
+            secretKey: "username"
+
+          - name: DOCUMENTATION_PG_PASSWORD
+            secretName:
+              _default: "postgres-secret-documentations"
+            secretKey: "password"
+
+          - name: FLOWS_DB_DB
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "database"
+
+          - name: FLOWS_DB_USERNAME
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: FLOWS_DB_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: ISSUES_DB_DB
+            secretName:
+              _default: "postgres-secret-issues"
+            secretKey: "database"
+
+          - name: ISSUES_DB_USERNAME
+            secretName:
+              _default: "postgres-secret-issues"
+            secretKey: "username"
+
+          - name: ISSUES_DB_PASSWORD
+            secretName:
+              _default: "postgres-secret-issues"
+            secretKey: "password"
+
+          - name: DJANGO_AUTH
+            secretName:
+              _default: "django-secret"
+            secretKey: "token"
+
+          - name: DJANGO_TOKEN
+            secretName:
+              _default: "django-secret"
+            secretKey: "token"
+
+          - name: PG_DB
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "database"
+
+          - name: PG_LOGIN
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: PG_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: RABBITMQ_USERNAME
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "username"
+
+          - name: RABBITMQ_PASSWORD
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "password"
+
+          - name: RABBITMQ_VHOST
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "vhost"
+
+          - name: KAFKA_USERNAME
+            secretName:
+              _default: "kafka-secret"
+            secretKey: "username"
+
+          - name: KAFKA_PASSWORD
+            secretName:
+              _default: "kafka-secret"
+            secretKey: "password"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/flows/wb/frontend.yaml

@@ -0,0 +1,95 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frontend
+  namespace: flows
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      frontend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_5b2bd144
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: frontend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          resources:
+            requests:
+              cpu:
+                _default: 100m
+              memory:
+                _default: 100Mi
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: frontend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/flows/wb/kafka-configmap.yaml

@@ -0,0 +1,67 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kafka-configmap
+  namespace: flows
+data:
+  kafka.py: |
+    import ssl
+    from functools import partial
+
+    import anyio
+    from faststream.kafka import KafkaBroker
+    from faststream.security import BaseSecurity
+
+    from flow.config import logger, settings
+    from flow.models.events import BaseEvent
+
+
+    def _build_broker() -> KafkaBroker:
+        ssl_context = ssl.create_default_context()
+
+        ssl_context.check_hostname = False
+        ssl_context.verify_mode = ssl.CERT_NONE
+
+        if settings.kafka.ssl_cert:
+            ssl_context.load_verify_locations(cadata=settings.kafka.ssl_cert)
+
+        security = BaseSecurity(
+            ssl_context=ssl_context,
+            use_ssl=True,
+        )
+
+        return KafkaBroker(
+            bootstrap_servers=[settings.kafka.host],
+            security=security,
+        )
+
+
+    broker = _build_broker()
+
+
+    async def _publish(event: BaseEvent, key: str) -> None:
+        await broker.publish(
+            message=event,
+            topic=event.metadata.event_type,
+            key=key.encode(),
+        )
+
+
+    def publish_event(event: BaseEvent, key: str) -> None:
+        if not settings.enable_events:
+            return
+
+        try:
+            anyio.from_thread.run(partial(_publish, event, key))
+        except Exception:
+            logger.exception(
+                "Failed to publish kafka event %s",
+                event.metadata.event_type,
+            )
+
+
+    __all__ = [
+        "broker",
+        "publish_event",
+    ]

apps/flows/wb/kustomization.yaml

@@ -0,0 +1,10 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: flows
+resources:
+  - authentication-configmap.yaml
+  - kafka-configmap.yaml
+  - backend.yaml
+  - celery.yaml
+  - frontend.yaml

apps/iam/wb/backend-s3.yaml

@@ -0,0 +1,87 @@
+---
+# В base S3_ENDPOINT_URL смотрит на storage.yandexcloud.net (Яндекс.Облако) —
+# в wb используется собственный self-hosted MinIO.
+# ZITADEL_HOST в base (sarex-login.uralmine.com) не трогаем: это общий
+# платформенный SSO для iam, не переопределяется ни в одном клиентском контуре.
+#
+# TODO: для iam в vault wb (1.yaml) ещё не заведён infrastructure.minio.apps.iam
+# (нет реального client.endpoint/bucket, в отличие от attachments/django/...) —
+# 10.49.10.90:9000 здесь взят по аналогии с остальными приложениями wb.
+# Проверить/поправить, когда в vault появится бакет для iam.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: iam-backend
+  namespace: iam
+spec:
+  values:
+    services:
+      backend:
+        envs:
+          - name: ENVIRONMENT
+            value:
+              _default: "prod"
+
+          - name: LOG_LEVEL
+            value:
+              _default: "debug"
+
+          - name: AUTH_ENABLED
+            value:
+              _default: "true"
+
+          - name: HTTP_PORT
+            value:
+              _default: "8080"
+
+          - name: HTTP_READ_BUFFER_SIZE
+            value:
+              _default: "131072"
+
+          - name: DB_MIGRATIONS_PATH
+            value:
+              _default: "migrations"
+
+          - name: ZITADEL_ENABLED
+            value:
+              _default: "true"
+
+          - name: ZITADEL_HOST
+            value:
+              _default: "https://sarex-login.uralmine.com"
+
+          - name: ZITADEL_ORG_RULES_FILE
+            value:
+              _default: "config/zitadel/org-rules-prod.json"
+
+          - name: S3_ENABLED
+            value:
+              _default: "true"
+
+          - name: S3_ENDPOINT_URL
+            value:
+              _default: "http://10.49.10.90:9000"
+
+          - name: S3_BUCKET_NAME
+            value:
+              _default: "sarex-media-storage"
+
+          - name: S3_REGION
+            value:
+              _default: "ru-central1"
+
+          - name: S3_PRESIGN_EXPIRES
+            value:
+              _default: "1h"
+
+          - name: KAFKA_ENABLED
+            value:
+              _default: "false"
+
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: "/etc/ca-certificates/Yandex/ca-cert"
+
+          - name: KAFKA_TOPIC_LEGACY_AMS_SYNC
+            value:
+              _default: "ams-sync"

apps/iam/wb/kustomization.yaml

@@ -1,10 +1,11 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+namespace: iam
 resources:
   - ../base
 patches:
-  - path: postgresql.yaml
+  - path: backend-s3.yaml
     target:
       kind: HelmRelease
-      name: postgresql
+      name: iam-backend

apps/inspections/wb/backend.yaml

@@ -0,0 +1,234 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: inspections-backend
+  namespace: inspections
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      api:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:production_1a33f6f4
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: inspections-backend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: sarex-inspections-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        envs:
+          - name: DEBUG
+            value:
+              _default: "false"
+
+          - name: SERVICE_URL
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: HTTP_APP_HOST
+            value:
+              _default: "0.0.0.0"
+
+          - name: HTTP_APP_PORT
+            value:
+              _default: "8000"
+
+          - name: HTTP_APP_ROOT_PATH
+            value:
+              _default: "/inspections"
+
+          - name: HTTP_APP_WORKERS
+            value:
+              _default: "3"
+
+          - name: HTTP_APP_ADMIN_ENABLE
+            value:
+              _default: "true"
+
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: "/usr/local/share/ca-certificates/Yandex/YandexInternalRootCA.crt"
+
+          - name: KAFKA_EAV_ASSETS_TOPIC
+            value:
+              _default: "assets_broadcast"
+
+          - name: JWT_AUTH_ENABLE
+            value:
+              _default: "true"
+
+          - name: NOTIFICATIONS_ENABLE
+            value:
+              _default: "true"
+
+          - name: NOTIFICATIONS_EMAIL_FROM
+            value:
+              _default: "hello@sarex.io"
+
+          - name: SAREX_BACKEND_URL
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: SAREX_BACKEND_TIMEOUT
+            value:
+              _default: "30"
+
+          - name: EAV_URL
+            value:
+              _default: "http://eav-service.eav"
+
+          - name: EAV_TIMEOUT
+            value:
+              _default: "30"
+
+          # В дампе кластера значение было http://workflows-service.processing-prod —
+          # тот же неймспейс, что в вопросе про processing/workflow: реальный
+          # ns у processing в wb — workflow.
+          - name: WORKFLOWS_URL
+            value:
+              _default: "http://workflows-service.workflow"
+
+          - name: WORKFLOWS_TIMEOUT
+            value:
+              _default: "30"
+
+          - name: WORKFLOWS_EMAIL_DOCKER_IMAGE
+            value:
+              _default: "cr.yandex/crp3ccidau046kdj8g9q/notification:email"
+
+          - name: MOBILE_APP_CURRENT_VERSION
+            value:
+              _default: "1.0.0"
+
+          - name: MOBILE_APP_RECOMMENDED_VERSION
+            value:
+              _default: "1.0.0"
+
+          - name: MOBILE_APP_REQUIRED_VERSION
+            value:
+              _default: "1.0.0"
+
+          - name: MAILER_URL
+            value:
+              _default: "http://mailer-service.mailer:8000"
+
+          - name: MAILER_TIMEOUT
+            value:
+              _default: "30"
+
+        secretEnvs:
+          - name: DATABASE_USER
+            secretName:
+              _default: "pg-secret"
+            secretKey: "username"
+
+          - name: DATABASE_PORT
+            secretName:
+              _default: "pg-secret"
+            secretKey: "port"
+
+          - name: DATABASE_NAME
+            secretName:
+              _default: "pg-secret"
+            secretKey: "database"
+
+          - name: DATABASE_HOST
+            secretName:
+              _default: "pg-secret"
+            secretKey: "host"
+
+          - name: DATABASE_PASSWORD
+            secretName:
+              _default: "pg-secret"
+            secretKey: "password"
+
+          - name: KAFKA_HOST
+            secretName:
+              _default: "kafka-secret"
+            secretKey: "host"
+
+          - name: KAFKA_USERNAME
+            secretName:
+              _default: "kafka-secret"
+            secretKey: "username"
+
+          - name: KAFKA_PASSWORD
+            secretName:
+              _default: "kafka-secret"
+            secretKey: "password"
+
+          - name: SAREX_BACKEND_AUTH
+            secretName:
+              _default: "sarex-backend-auth-secret"
+            secretKey: "key"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/inspections/wb/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: inspections
+resources:
+  - backend.yaml

apps/issues/base/backend.yaml

@@ -42,7 +42,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_2dc38909
+            _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_bbb9d29a
           pullPolicy:
             _default: IfNotPresent
 

apps/issues/base/celery.yaml

@@ -42,7 +42,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_2dc38909
+            _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_bbb9d29a
           pullPolicy:
             _default: IfNotPresent
 

apps/issues/base/frontend.yaml

@@ -36,7 +36,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/contour_issues-frontend:716a2b73
+            _default: cr.yandex/crp3ccidau046kdj8g9q/contour_issues-frontend:b56b9da1
           pullPolicy:
             _default: IfNotPresent
 

apps/issues/brusnika-stage/backend.yaml

@@ -176,10 +176,6 @@ spec:
           - name: API_ADDRESS
             value:
               _default: "8000"
-
-          - name: RABBITMQ_HOSTNAME
-            value:
-              _default: "rabbitmq-service:5672"
         secretEnvs:
           - name: YC_S3_ACCESS_KEY_ID
             secretName:
@@ -231,19 +227,24 @@ spec:
               _default: "postgres-secret"
             secretKey: "database"
 
+          - name: RABBITMQ_HOSTNAME
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "hostname"
+
           - name: RABBITMQ_VHOST
             secretName:
-              _default: "rabbitmq-secret"
+              _default: "rabbitmq"
             secretKey: "vhost"
 
           - name: RABBITMQ_USERNAME
             secretName:
-              _default: "rabbitmq-secret"
+              _default: "rabbitmq"
             secretKey: "username"
 
           - name: RABBITMQ_PASSWORD
             secretName:
-              _default: "rabbitmq-secret"
+              _default: "rabbitmq"
             secretKey: "password"
 
           - name: JWT_PRIVATE_KEY

apps/issues/brusnika-stage/celery.yaml

@@ -187,10 +187,6 @@ spec:
           - name: API_ADDRESS
             value:
               _default: "8000"
-
-          - name: RABBITMQ_HOSTNAME
-            value:
-              _default: "rabbitmq-service:5672"
         secretEnvs:
           - name: YC_S3_ACCESS_KEY_ID
             secretName:
@@ -242,19 +238,24 @@ spec:
               _default: "postgres-secret"
             secretKey: "database"
 
+          - name: RABBITMQ_HOSTNAME
+            secretName:
+              _default: "rabbitmq"
+            secretKey: "hostname"
+
           - name: RABBITMQ_VHOST
             secretName:
-              _default: "rabbitmq-secret"
+              _default: "rabbitmq"
             secretKey: "vhost"
 
           - name: RABBITMQ_USERNAME
             secretName:
-              _default: "rabbitmq-secret"
+              _default: "rabbitmq"
             secretKey: "username"
 
           - name: RABBITMQ_PASSWORD
             secretName:
-              _default: "rabbitmq-secret"
+              _default: "rabbitmq"
             secretKey: "password"
 
           - name: JWT_PRIVATE_KEY

apps/issues/wb/app-configmap.yaml

@@ -0,0 +1,55 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: app
+  namespace: issues
+data:
+  app.py: |
+    import ssl
+    from django.conf import settings
+    from faststream import FastStream
+    from faststream.kafka import KafkaBroker
+    from faststream.security import BaseSecurity
+
+
+    def get_broker() -> KafkaBroker:
+        ssl_context = ssl.create_default_context(
+            cafile=settings.KAFKA_SSL_CAFILE,
+        )
+
+        # Сертификат передаем, но hostname не проверяем
+        ssl_context.check_hostname = False
+
+        # Для самоподписанного сертификата
+        ssl_context.verify_mode = ssl.CERT_NONE
+
+        security = BaseSecurity(
+            ssl_context=ssl_context,
+            use_ssl=True,
+        )
+
+        broker = KafkaBroker(
+            bootstrap_servers=[settings.KAFKA_HOST],
+            security=security,
+        )
+
+        return broker
+
+
+    def get_consumer_broker() -> KafkaBroker:
+        broker = get_broker()
+
+        from kafka_app.consumers import eav_router
+
+        broker.include_router(eav_router)
+
+        return broker
+
+
+    def configure_app() -> FastStream:
+        broker = get_consumer_broker()
+
+        app = FastStream(broker)
+
+        return app

apps/issues/wb/celery.yaml

@@ -0,0 +1,281 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: celery
+  namespace: issues
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      celery:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_bbb9d29a
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: celery
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          command:
+            _default: ["celery", "-A", "config", "worker", "-l", "info", "-E"]
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: false
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: kafka-cert-volume
+              mountPath:
+                _default: /usr/local/share/ca-certificates
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: kafka-cert
+
+            - name: app
+              mountPath:
+                _default: /src/kafka_app/app.py
+              subPath:
+                _default: app.py
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: app
+                items:
+                  - key: app.py
+                    path:
+                      _default: app.py
+
+            - name: uwsgi-configmap
+              mountPath:
+                _default: /opt/server/uwsgi.ini
+              subPath:
+                _default: uwsgi.ini
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: uwsgi-configmap
+                items:
+                  - key: uwsgi.ini
+                    path:
+                      _default: uwsgi.ini
+
+            - name: production-configmap
+              mountPath:
+                _default: /src/config/settings/production.py
+              subPath:
+                _default: production.py
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: production-configmap
+                items:
+                  - key: production.py
+                    path:
+                      _default: production.py
+
+        envs:
+          - name: ENVIRONMENT
+            value:
+              _default: "production"
+
+          - name: AERO_PUBLIC_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: AERO_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: BASE_AERO_URL
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: BASE_AUTH_URL
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: WORKFLOWS_HOST
+            value:
+              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000"
+
+          - name: WORKFLOWS_URL
+            value:
+              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000"
+
+          - name: RESOURCES_API_HOST
+            value:
+              _default: "http://resources-service.resources.svc.cluster.local:8000"
+
+          - name: EAV_HOST
+            value:
+              _default: "http://eav-service.eav.svc.cluster.local:8000"
+
+          - name: USE_NOTIFICATIONS
+            value:
+              _default: "True"
+
+          - name: ENABLE_MAILGUN
+            value:
+              _default: "False"
+
+          - name: SAREX_API
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: DOCUMENTATIONS_URL
+            value:
+              _default: "http://documentations-api.documentations.svc.cluster.local:8080"
+
+          - name: DJANGO_SETTINGS_MODULE
+            value:
+              _default: "config.settings.production"
+
+          - name: DATABASE_HOST
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: DATABASE_PORT
+            value:
+              _default: "5432"
+
+          - name: API_ADDRESS
+            value:
+              _default: "8000"
+
+          - name: RABBITMQ_HOSTNAME
+            value:
+              _default: "rabbitmq.rabbitmq.svc.cluster.local:5672"
+
+        secretEnvs:
+          - name: YC_S3_ACCESS_KEY_ID
+            secretName:
+              _default: "yc-s3-secret"
+            secretKey: "key_id"
+
+          - name: YC_S3_SECRET_ACCESS_KEY
+            secretName:
+              _default: "yc-s3-secret"
+            secretKey: "access_key"
+
+          - name: YC_S3_BUCKET_NAME
+            secretName:
+              _default: "yc-s3-secret"
+            secretKey: "storage_bucket_name"
+
+          - name: YC_S3_ENDPOINT_URL
+            secretName:
+              _default: "yc-s3-secret"
+            secretKey: "endpoint_url"
+
+          - name: DJANGO_BASIC_AUTH
+            secretName:
+              _default: "django-auth"
+            secretKey: "key"
+
+          - name: SAREX_USERNAME
+            secretName:
+              _default: "sarex-auth"
+            secretKey: "username"
+
+          - name: SAREX_PASSWORD
+            secretName:
+              _default: "sarex-auth"
+            secretKey: "password"
+
+          - name: DATABASE_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: DATABASE_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: DATABASE_NAME
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "database"
+
+          - name: RABBITMQ_VHOST
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "vhost"
+
+          - name: RABBITMQ_USERNAME
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "username"
+
+          - name: RABBITMQ_PASSWORD
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "password"
+
+          - name: JWT_PRIVATE_KEY
+            secretName:
+              _default: "backend-secret"
+            secretKey: "ssh_private.key"
+
+          - name: JWT_PUBLIC_KEY
+            secretName:
+              _default: "backend-secret"
+            secretKey: "ssh_public.key"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/issues/wb/issues.yaml

@@ -0,0 +1,270 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: issues
+  namespace: issues
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      issues:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_bbb9d29a
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: issues
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: issues-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: kafka-cert-volume
+              mountPath:
+                _default: /usr/local/share/ca-certificates
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: kafka-cert
+
+            - name: uwsgi-configmap
+              mountPath:
+                _default: /opt/server/uwsgi.ini
+              subPath:
+                _default: uwsgi.ini
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: uwsgi-configmap
+                items:
+                  - key: uwsgi.ini
+                    path:
+                      _default: uwsgi.ini
+
+            - name: production-configmap
+              mountPath:
+                _default: /src/config/settings/production.py
+              subPath:
+                _default: production.py
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: production-configmap
+                items:
+                  - key: production.py
+                    path:
+                      _default: production.py
+
+        envs:
+          - name: ENVIRONMENT
+            value:
+              _default: "production"
+
+          - name: AERO_PUBLIC_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: AERO_HOST
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: BASE_AERO_URL
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: BASE_AUTH_URL
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+          - name: WORKFLOWS_HOST
+            value:
+              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000"
+
+          - name: WORKFLOWS_URL
+            value:
+              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000"
+
+          - name: RESOURCES_API_HOST
+            value:
+              _default: "http://resources-service.resources.svc.cluster.local:8000"
+
+          - name: EAV_HOST
+            value:
+              _default: "http://eav-service.eav.svc.cluster.local:8000"
+
+          - name: SAREX_API
+            value:
+              _default: "https://srx.wb.ru"
+
+          - name: DOCUMENTATIONS_URL
+            value:
+              _default: "http://documentations-api.documentations.svc.cluster.local:8080"
+
+          - name: DJANGO_SETTINGS_MODULE
+            value:
+              _default: "config.settings.production"
+
+          - name: DATABASE_HOST
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: DATABASE_PORT
+            value:
+              _default: "5432"
+
+          - name: API_ADDRESS
+            value:
+              _default: "8000"
+
+          - name: RABBITMQ_HOSTNAME
+            value:
+              _default: "rabbitmq.rabbitmq.svc.cluster.local:5672"
+
+        secretEnvs:
+          - name: YC_S3_ACCESS_KEY_ID
+            secretName:
+              _default: "yc-s3-secret"
+            secretKey: "key_id"
+
+          - name: YC_S3_SECRET_ACCESS_KEY
+            secretName:
+              _default: "yc-s3-secret"
+            secretKey: "access_key"
+
+          - name: YC_S3_BUCKET_NAME
+            secretName:
+              _default: "yc-s3-secret"
+            secretKey: "storage_bucket_name"
+
+          - name: YC_S3_ENDPOINT_URL
+            secretName:
+              _default: "yc-s3-secret"
+            secretKey: "endpoint_url"
+
+          - name: DJANGO_BASIC_AUTH
+            secretName:
+              _default: "django-auth"
+            secretKey: "key"
+
+          - name: SAREX_USERNAME
+            secretName:
+              _default: "sarex-auth"
+            secretKey: "username"
+
+          - name: SAREX_PASSWORD
+            secretName:
+              _default: "sarex-auth"
+            secretKey: "password"
+
+          - name: DATABASE_USER
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "username"
+
+          - name: DATABASE_PASSWORD
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "password"
+
+          - name: DATABASE_NAME
+            secretName:
+              _default: "postgres-secret"
+            secretKey: "database"
+
+          - name: RABBITMQ_VHOST
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "vhost"
+
+          - name: RABBITMQ_USERNAME
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "username"
+
+          - name: RABBITMQ_PASSWORD
+            secretName:
+              _default: "rabbitmq-secret"
+            secretKey: "password"
+
+          - name: JWT_PRIVATE_KEY
+            secretName:
+              _default: "backend-secret"
+            secretKey: "ssh_private.key"
+
+          - name: JWT_PUBLIC_KEY
+            secretName:
+              _default: "backend-secret"
+            secretKey: "ssh_public.key"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/issues/wb/kafka-cert-configmap.yaml

@@ -0,0 +1,38 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kafka-cert
+  namespace: issues
+data:
+  kafka.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIIFLTCCAxWgAwIBAgIUA5L48eHPMqNFYE5wIgaOmWgG3okwDQYJKoZIhvcNAQEN
+    BQAwLTETMBEGA1UECgwKaW8uc3RyaW16aTEWMBQGA1UEAwwNY2x1c3Rlci1jYSB2
+    MDAeFw0yNTA2MDQxMTMzMTRaFw0yNjA2MDQxMTMzMTRaMC0xEzARBgNVBAoMCmlv
+    LnN0cmltemkxFjAUBgNVBAMMDWNsdXN0ZXItY2EgdjAwggIiMA0GCSqGSIb3DQEB
+    AQUAA4ICDwAwggIKAoICAQDV2NBVwnXISH9i8K4KxSd2AThwgQyRKyeIfcqeYZ4F
+    7FguEUI7uEtoWd4uO8DsIzoMoLYv5L1DfhNYUFWN3XYQd4XVFnwYQYbwspdC1L8G
+    u0T7943gRRRomcNP8n5nycfeZgZgmz9IS8vmxgRh4ao0kcCW49uBQMd706087UAI
+    qaRJTcabTZq1LTeoH9AOAyT/nawKm+1H5VmrMUBjzz9xKVXF0sCrhjYoZoM4x+fY
+    AphtxZDB21ZhEcHBbytEQkEm0QTbUP4xbu95yqY6goYi9S9R1uMgVZ9DoJVwyqLm
+    /3ZGPjd9VmdBPO/zE/Bj890DjyKS7AXo9d+Iyv4M2QD1jA+5j4JyHzk7Lroz+HTg
+    mwVpcVGafBWIC4qFt7C3UYt6IV64/MA2v9gxTIdJvOBZxKUiMl7f65jKNEntF6is
+    86QCkjhvt34AThEoGx8SPjVr3sOBuneqcybeSYLyEWFg9Z1mWfMLHlA/Fp/Y2wpM
+    w1ZXj6uAa/UNUAIfkaLTOKHHaCCVD2G3Vkm94NHOJmDj6ze8P0J0H+Ub6ULD7hHr
+    8obOSk9OvxoxVzE+UW7DyEL6YD8MBVUQKJIQVgZmpT4akWyz8bNhFRzgTnKAhwNN
+    ATrGmjfX/wj7tCpy/PoJjEiu54sXW5xplBIz/ZgYHrPkyrbhQxsRozgQ+UIMIIbJ
+    /wIDAQABo0UwQzAdBgNVHQ4EFgQUkU4HKndgWxhcXMAe5XBc4OJwSgcwEgYDVR0T
+    AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQENBQADggIB
+    AFLi5QLawZollou3+m5kYcBe5F8xKG5NlgNmKyIREnwD2AP4xrr2tNFbmP2hpEl4
+    bWJJ84IHlKjpYxFLboWzgtW/JvdxcEh0K/x8/7cOD3Kk9d/LR9muj57mFYSQGlbo
+    g0+lHNuLam8xGcnGVV5VdfcjFz72/q92ndTlJmz+v6OneTJvIypKoBmNKF25alz9
+    pR2sTwoG0Pcwm30u/uS6pOewQ4sTiniOcc1MFYF7tl/Zz9Mqza8Rer0B5nm8lE/J
+    Yo9UaEXyVLM8Y5kSOkxMlOK+8/UMeY/lcQYpd5tYVpvarnoPCjmUjt4iVw26ZsAH
+    y4/vNW+wX+Uauarik1jHL/SauAjS3FbJoH06BBnji7J/Rud2DtSd+vVZrIBLJkaH
+    +Xg/roD3xKx0XmhLJmPvxGrkyehbhkbJkPKCHa9P56rnev3MYjyy+SV7Vp8Dq+HF
+    Wkswl3QUPWx9reuvF2KMyt04Tw94UAxCUGkX5qg7Dq5d0Fj/AcIrFdLTCV8eG/UI
+    1kKRxmZ2/ALINBOlfJOVVovKBlWpPACs8iy6XreOXtoQfzoG2F9Vo3Jmzjpqsmz0
+    9Ao4s2vcz3UuDtBhpwGp4N3zroyst/kQjtZirj4cS7fu75tB5N5mQ/tTwg0Tiw+Y
+    XIdxeE73V5DAf4Dd5V1VdCbA6oQv5qJYvinYydyx4x3V
+    -----END CERTIFICATE-----

apps/issues/wb/kustomization.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: issues
+resources:
+  - app-configmap.yaml
+  - production-configmap.yaml
+  - uwsgi-configmap.yaml
+  - kafka-cert-configmap.yaml
+  - issues.yaml
+  - celery.yaml
+  - redis.yaml
+  - static.yaml
+  - remarks-static.yaml

apps/issues/wb/production-configmap.yaml

@@ -0,0 +1,143 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: production-configmap
+  namespace: issues
+data:
+  production.py: |
+    from datetime import timedelta
+    import os
+    from .base import *
+
+    # DEBUG SETTINGS START
+    # -----------------------------------------------------------------------------
+    DEBUG = True
+    # -----------------------------------------------------------------------------
+
+    TEST_MODE = False
+    #USE_NOTIFICATIONS = False
+    AWS_S3_VERIFY=False
+
+    # SECRETS SETTINGS START
+    # -----------------------------------------------------------------------------
+    SECRET_KEY = "FromToMuchLoveOfLiving"  # Delete after Test
+    # -----------------------------------------------------------------------------
+
+    DJANGO_TOKEN="aGFnZW4wMTM6emVhbG90MDk2"
+
+    # ALLOWED HOSTS START
+    # -----------------------------------------------------------------------------
+    ALLOWED_HOSTS = ["*"]
+    # -----------------------------------------------------------------------------
+
+    # APPS SETTINGS START
+    # -----------------------------------------------------------------------------
+    # INSTALLED_APPS += [
+    #     "django_extensions",
+    # ]
+    # -----------------------------------------------------------------------------
+
+    # DEBUG SETTINGS START
+    # -----------------------------------------------------------------------------
+    DEBUG = True
+    # -----------------------------------------------------------------------------
+
+    REVIEW_HOST='http://backend-service.flows.svc.cluster.local:8000'
+    # -----------------------------------------------------------------------------
+    # EXTERNAL SERVICES END
+
+    WORKFLOWS_HOST = "http://workflows-api-service.workflow.svc.cluster.local:8000"
+    WORKFLOWS_URL = "http://workflows-api-service.workflow.svc.cluster.local:8000"
+    DOCUMENTATIONS_URL = "http://documentations-api.documentations.svc.cluster.local:8080"
+    RESOURCES_API_HOST = os.getenv("RESOURCES_API_HOST", default="http://resources-service.resources.svc.cluster:8000")
+    KAFKA_HOST = "wb-prod-kafka-bootstrap.kafka.svc.cluster.local:9093"
+    KAFKA_USERNAME = "sarex"
+    KAFKA_PASSWORD = "nK36sasvSfoItJnXQ4qxav2OUWIPX5ZC"
+    KAFKA_SSL_CAFILE = os.getenv("KAFKA_SSL_CAFILE", "/usr/local/share/ca-certificates/kafka.crt")
+    KAFKA_EAV_ASSETS_TOPIC = os.getenv("KAFKA_EAV_ASSETS_TOPIC", "sarex")
+    KAFKA_ISSUES_TOPIC = os.getenv("KAFKA_ISSUES_TOPIC", "sarex-issues")
+
+
+    USE_ASYNC_FUNCTIONS = True
+    #USE_NOTIFICATIONS = False
+
+    # JWT SETTINGS START
+    # ---------------------------------------------------------------------------------------------------------------------
+    SIMPLE_JWT_ISSUER = os.getenv("SIMPLE_JWT_ISSUER", default="default_issuer")
+
+    SIMPLE_JWT = {
+        "ACCESS_TOKEN_LIFETIME": timedelta(minutes=5),
+        "REFRESH_TOKEN_LIFETIME": timedelta(days=1),
+        "ROTATE_REFRESH_TOKENS": False,
+        "UPDATE_LAST_LOGIN": False,
+
+        "ALGORITHM": "RS512",
+        "SIGNING_KEY": os.getenv("JWT_PRIVATE_KEY", default="").replace("\\n", "\n"),
+        "VERIFYING_KEY": os.getenv("JWT_PUBLIC_KEY").replace("\\n", "\n"),
+        "AUDIENCE": None,
+        "ISSUER": SIMPLE_JWT_ISSUER,
+
+        "AUTH_HEADER_TYPES": ("Bearer",),
+        "AUTH_HEADER_NAME": "HTTP_AUTHORIZATION",
+        "USER_ID_FIELD": "id",
+        "USER_ID_CLAIM": "user_id",
+
+        "AUTH_TOKEN_CLASSES": ("rest_framework_simplejwt.tokens.AccessToken",),
+        "TOKEN_TYPE_CLAIM": "token_type",
+
+        "JTI_CLAIM": "jti",
+
+        "SLIDING_TOKEN_REFRESH_EXP_CLAIM": "refresh_exp",
+        "SLIDING_TOKEN_LIFETIME": timedelta(minutes=5),
+        "SLIDING_TOKEN_REFRESH_LIFETIME": timedelta(days=1),
+    }
+    # ---------------------------------------------------------------------------------------------------------------------
+
+    CORS_ALLOWED_ORIGINS = [
+        "https://lk.srx.wb.ru:30443",
+    ]
+
+    CORS_TRUSTED_ORIGINS = [
+        "https://lk.srx.wb.ru:30443",
+    ]
+
+    CSRF_TRUSTED_ORIGINS = [
+        "https://lk.srx.wb.ru:30443",
+    ]
+
+    CORS_ALLOW_ALL_ORIGINS = True
+    ENABLE_MAILGUN=False
+    SMTP_PORT=465
+    SMTP_HOST="mail.rwb.ru"
+    EMAIL_FROM="sarex@rwb.ru"
+
+    CORS_ALLOW_METHODS = [
+        "DELETE",
+        "GET",
+        "OPTIONS",
+        "PATCH",
+        "POST",
+        "PUT",
+    ]
+
+    SAREX_API = "https://srx.wb.ru"
+
+    AERO_PUBLIC_HOST = os.getenv("AERO_PUBLIC_HOST", default=SAREX_API)
+
+    BASE_AERO_URL = "http://backend.django.svc.cluster.local:8000"
+
+    ENVIRONMENT = "production"
+
+    SESSION_COOKIE_NAME = "issues-sessionid"
+    CSRF_COOKIE_NAME = "issues-csrftoken"
+    STATIC_URL = "/static/"
+    STORAGES = {
+        'default': {
+            'BACKEND': "storages.backends.s3boto3.S3Boto3Storage",
+        },
+        'staticfiles': {
+            # Leave whatever setting you already have here, e.g.:
+            'BACKEND': "storages.backends.s3boto3.S3Boto3Storage",
+        }
+    }

apps/issues/wb/redis.yaml

@@ -0,0 +1,88 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: redis
+  namespace: issues
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      redis:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/redis:latest
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: redis
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 6379
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: redis
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 6379
+
+          targetPort:
+            _default: 6379
+
+          portName:
+            _default: tcp
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/issues/wb/remarks-static.yaml

@@ -0,0 +1,90 @@
+---
+# remarks-static — компонент приложения remarks (apps/remarks), в wb
+# развёрнут в ns issues, а не в своём собственном неймспейсе.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: remarks-static
+  namespace: issues
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      remarks-static:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/remarks-frontend:wb_2c0adf31
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: remarks-static
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8080
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: remarks-static
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 8080
+
+          portName:
+            _default: tcp
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/issues/wb/static.yaml

@@ -0,0 +1,88 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: static
+  namespace: issues
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      static:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/contour_issues-frontend:b56b9da1
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: static
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 80
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: static-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 80
+
+          targetPort:
+            _default: 80
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/issues/wb/uwsgi-configmap.yaml

@@ -0,0 +1,23 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: uwsgi-configmap
+  namespace: issues
+data:
+  uwsgi.ini: |-
+    [uwsgi]
+    plugins-dir = /usr/lib/uwsgi/plugins
+
+    chdir           = /src
+    module          = config.wsgi:application
+    master          = true
+    processes       = 4
+    http            = 0.0.0.0:8000
+    chmod-socket    = 666
+    vacuum          = true
+    harakiri        = 6000
+    buffer-size     = 32768
+
+    static-map = /static=/opt/src/static/
+    static-map = /media=/opt/src/media/

apps/measurements/aero/kustomization.yaml

@@ -1,41 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: measurements
-resources:
-  - ../base
-
-patches:
-  - target: {kind: HelmRelease, name: measurements}
-    patch: |
-      # Имя сервиса приводим к measurements-service, как в brusnika-*.
-      #
-      # В base сервис называется measurements-svc, а django ходит на
-      #   MEASUREMENTS_HOST=http://measurements-service.measurements.svc.cluster.local:8000/api
-      # (apps/django/base/backend.yaml). Переименовать сервис дешевле, чем
-      # патчить переменную в двух релизах django (backend и celery), и заодно
-      # совпадает с тем, как это сделано в остальных кластерах.
-      - op: replace
-        path: /spec/values/services/backend/service/name/_default
-        value: measurements-service
-
-      # S3: бакет берём из секрета, а не из шаблона.
-      #
-      # В base имя бакета ЗАШИТО прямо в vault-шаблоне — "buckets":["measurements"].
-      # Из-за этого measurements складывал файлы в собственный бакет, тогда как
-      # медиахранилище контура одно и называется sarex-media-storage: туда пишет
-      # django (S3_BUCKET) и оттуда же раздаёт s3-proxy на маршруте /media/.
-      # Разные бакеты означали, что ссылка на файл измерения, отданная через
-      # django, вела бы в пустоту.
-      #
-      # Endpoint в base уже приезжает из секрета (.Data.data.client.endpoint) —
-      # достраиваем до той же схемы и бакет, чтобы имя задавалось в ОДНОМ месте
-      # (vault_app_secrets в aero/roles/sarex_stack/defaults/main.yml), а не
-      # дублировалось в манифесте. Заменить можно только аннотацию целиком:
-      # значение зашито внутри шаблона, через values его не перекрыть.
-      - op: replace
-        path: /spec/values/services/backend/podAnnotations/_default/vault.hashicorp.com~1agent-inject-template-measurements-s3
-        value: |-
-          {{- with secret "secrets/data/minio/apps/measurements" -}}
-          S3_JSON_SETTINGS='{"host":"{{ index .Data.data.client "endpoint" }}","login":"{{ index .Data.data "access_key" }}","password":"{{ index .Data.data "secret_key" }}","verify":false,"buckets":["{{ index .Data.data "bucket" }}"]}'
-          {{- end -}}

apps/message-hub/wb/kafka-cert-configmap.yaml

@@ -0,0 +1,38 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kafka-cert
+  namespace: message-hub
+data:
+  kafka.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIIFLTCCAxWgAwIBAgIUYDZPxGRsr7IiqHEmfd07QTQlOKYwDQYJKoZIhvcNAQEN
+    BQAwLTETMBEGA1UECgwKaW8uc3RyaW16aTEWMBQGA1UEAwwNY2x1c3Rlci1jYSB2
+    MDAeFw0yNTEyMTYxNDM0NTVaFw0yNjEyMTYxNDM0NTVaMC0xEzARBgNVBAoMCmlv
+    LnN0cmltemkxFjAUBgNVBAMMDWNsdXN0ZXItY2EgdjAwggIiMA0GCSqGSIb3DQEB
+    AQUAA4ICDwAwggIKAoICAQCfzDZhEzw2pbU5Xpu8OzD+3iQG+DVjU8PQWWQEF27h
+    yjohDkUr3zCZtW7xMKWKUNxBgrKsfe4TDOQN8cij3cS9sy0So+UhMeF7Bq9PU1Yd
+    bmTRq8q1PiuNUkiCGJ5wrb3+NZvVxZLJUIFgiealsRw80MgMWWSzy0I35T2Edn/a
+    DU4jhlgQxyzQ621+oGP0n28gCjmm6pCq2tkj/Z8WTdu1gOWyRdK02a2uE2Ts2nLa
+    Di32GaZrIbIuD/WUd6Ek66uCeJvh2CT7s+SqgtMbtT7gibUuPQ3hk1VGQsjy22l3
+    hUNpLu86nrwbuf21mY55KnLOcaVq1ag1TpIIKfZAL/KWFCGZ6H6kwEIbCAL0Hei7
+    cJ2Wm2/qlzKUeU869M7YybZAfXl/t6XT4QgFgje+42N980vy5A4GhWi1Z7lPqqOe
+    jPGBstkRZybKz1sTk87+oJx82iQU/ozVmzjSEK1SoYRNbvug8PNpxmPoPnJ2flgG
+    t2q2+2ZQP3f1aAHVcZ3U5+hWlRmKPXzjrJv7gnhuvqJl7OwB50y+yWiVfZ9xrYl2
+    EpX+yHuFFK+9NnB5taUK8Fz+hQaLU8J4q7P0bRqkoI+LdcEErjuDT/eI2d5+Ql8K
+    /JkV823hX2WNB9bdaQ24BelVUbsxGpR7ms6KWrM11kHnbzUlEM+AxZES6F7Qbr55
+    TwIDAQABo0UwQzAdBgNVHQ4EFgQUM7hshx7e9TFEN82Pf446aBrJUA4wEgYDVR0T
+    AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQENBQADggIB
+    AFNHFGPDxY966fz0dxDFFSfeo47y7XQZMK9xAwH73cQoSeqx+IMxzgM8nfJQ9XMN
+    PeLwVRZ7pvRee2ZhUPglBSTHnW2rvfmLBOO9xyKZxRsCkoFxuHH9xfM7bFWb96R6
+    fGrOdEZDB3yj00T+tkubwqt+/dUhQUj8juwyPs55WMb/0BIbapaoQ6QOP13CaXDV
+    ZmAfsEEIBkNxfq7GTr/z0Rq0B4+9FxAf3Jrsmi/dYoFD/prHsvBDkYw1daoFyp5C
+    tbctvB9wtphnCCynekt8UBvpVKHUU/xaUa09TQTToXjBbV1SZeIOHNG0MNbWa4sz
+    AL/cpXdq1EAxiTeAVT9XhCwhe/xJvFZIWuFLmW3J+ZxrOUCKieCYpTqBY2tBkkDY
+    //egic787yTR6zxqQNSzvNU5LhzrN7lu+KHGM06T35+HvpzgPPiRCzsxO62p63op
+    mq04K31yYZgLiqeAj5W+rioRGJNn4TXJpH9KIrzmGM7lVWLYWMAKeZU4r1lDUdcu
+    7jsBH8BRJWJeVK3xVw2HB3lk7Xn0WrR92adeYQ3f0vKbMIAVUnSJ3yCKJ4NMFSki
+    j78nx2mi/G0RhUPGZ9hhLXQKj9BtbpEnwpbGWtf0ShtVOxD/HKLCr7koBtW9TMPS
+    9K0sJhE5VjsQLkDDu9p3GdRcuLNA/oa7xFvRFtqGFsLj
+    -----END CERTIFICATE-----

apps/message-hub/wb/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: message-hub
+resources:
+  - kafka-cert-configmap.yaml
+  - message-hub.yaml

apps/message-hub/wb/message-hub.yaml

@@ -0,0 +1,209 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: message-hub
+  namespace: message-hub
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      message-hub:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/message-hub:production_e8010fe4
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: message-hub-message-hub
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: message-hub-message-hub
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: kafka-cert-volume
+              mountPath:
+                _default: /usr/local/share/ca-certificates
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: kafka-cert
+
+        envs:
+          - name: WORKER_TIMEOUT
+            value:
+              _default: "60"
+
+          - name: PYTHONPATH
+            value:
+              _default: "src"
+
+          - name: SETTINGS_MAX_RETRIES
+            value:
+              _default: "1"
+
+          - name: SETTINGS_TOPICS
+            value:
+              _default: '{"planning": "pm", "assets": "assets_broadcast", "project_entity": "issues_broadcast"}'
+
+          - name: SETTINGS_PDF_CONVERTER_HOST
+            value:
+              _default: "http://export-project-service.django.svc.cluster.local:8000"
+
+          - name: SAREX_BASE_HOST
+            value:
+              _default: "http://backend-service.pm.svc.cluster.local:8000"
+
+          - name: DB_HOST
+            value:
+              _default: "sarex-vpsql-01.xc.wb.ru"
+
+          - name: DB_PORT
+            value:
+              _default: "5432"
+
+          - name: DB_DATABASE
+            value:
+              _default: "pm_db"
+
+          - name: CACHE_HOST
+            value:
+              _default: "redis.pm.svc.cluster.local"
+
+          - name: CACHE_PORT
+            value:
+              _default: "6379"
+
+          - name: CACHE_SSL
+            value:
+              _default: "0"
+
+          - name: KAFKA_HOST
+            value:
+              _default: "wb-prod-kafka-bootstrap.kafka.svc.cluster.local"
+
+          - name: KAFKA_PORT
+            value:
+              _default: "9093"
+
+          - name: KAFKA_SECURITY_PROTOCOL
+            value:
+              _default: "SSL"
+
+          - name: KAFKA_SASL_MECHANISM
+            value:
+              _default: "SCRAM-SHA-512"
+
+          - name: KAFKA_SSL_CAFILE
+            value:
+              _default: "/usr/local/share/ca-certificates/kafka.crt"
+
+        secretEnvs:
+          - name: KAFKA_USERNAME
+            secretName:
+              _default: "kafka-secret"
+            secretKey: "username"
+
+          - name: KAFKA_PASSWORD
+            secretName:
+              _default: "kafka-secret"
+            secretKey: "password"
+
+          - name: DB_USERNAME
+            secretName:
+              _default: "postgres-pm-secret"
+            secretKey: "username"
+
+          - name: DB_PASSWORD
+            secretName:
+              _default: "postgres-pm-secret"
+            secretKey: "password"
+
+          - name: S3_LOGIN
+            secretName:
+              _default: "s3-secret"
+            secretKey: "username"
+
+          - name: S3_PASSWORD
+            secretName:
+              _default: "s3-secret"
+            secretKey: "password"
+
+          - name: S3_BUCKET
+            secretName:
+              _default: "s3-secret"
+            secretKey: "bucket"
+
+          - name: S3_HOST
+            secretName:
+              _default: "s3-secret"
+            secretKey: "host"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/notes/wb/backend.yaml

@@ -0,0 +1,55 @@
+---
+# Патч backend для контура wb.
+#
+# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
+# поэтому здесь продублирован весь набор из apps/notes/base/backend.yaml.
+#
+# DJANGO_HOST/BASE_HOST/FAAS_SERVICE/WORKSPACE_URL/WORKFLOW_HOST/RESOURCE_URL
+# в base смотрят на домен sarex.io (lk.sarex.io, api.sarex.io/<service>) —
+# для wb это lk.srx.wb.ru:30443/<service>, по аналогии с rfi/transmittal.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: notes
+spec:
+  values:
+    services:
+      backend:
+        envs:
+          - name: PG_SSL_MODE
+            value:
+              _default: verify-full
+          - name: DJANGO_HOST
+            value:
+              _default: https://lk.srx.wb.ru:30443
+          - name: BASE_HOST
+            value:
+              _default: https://lk.srx.wb.ru:30443/notes
+          - name: TIMEOUT
+            value:
+              _default: "120"
+          - name: FAAS_SERVICE
+            value:
+              _default: https://lk.srx.wb.ru:30443/lambdas
+          - name: WORKSPACE_URL
+            value:
+              _default: https://lk.srx.wb.ru:30443/workspaces/api/v1
+          - name: WORKFLOW_HOST
+            value:
+              _default: https://lk.srx.wb.ru:30443/workflows/api/v1
+          - name: WORKFLOW_TAG
+            value:
+              _default: stable
+          - name: RESOURCE_URL
+            value:
+              _default: https://lk.srx.wb.ru:30443/resources/api/v1
+          - name: SYNC_RESOURCE_ID
+            value:
+              _default: "0"
+          - name: ENABLE_ND
+            value:
+              _default: "0"
+          - name: ATTACHMENT_HOST
+            value:
+              _default: http://attachments-service.attachments.svc.cluster.local:80/api/v1

apps/notes/wb/kustomization.yaml

@@ -1,10 +1,11 @@
 ---
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+namespace: notes
 resources:
   - ../base
 patches:
-  - path: istio-config.yaml
+  - path: backend.yaml
     target:
       kind: HelmRelease
-      name: istio-config
+      name: backend

apps/pm/wb/backend-configmap.yaml

@@ -0,0 +1,30 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: backend-configmap
+  namespace: pm
+data:
+  uwsgi.ini: |
+    [uwsgi]
+    log-format = {"time": "%(time)", "method": "%(method)", "uri": "%(uri)", "status": "%(status)", "size": "%(size)", "addr": "%(addr)", "user": "%(user)", "proto": "%(proto)", "user_agent": "%(uagent)", "referer": "%(referer)", "trace_id": "%(trace_id)", "span_id": "%(span_id)"}
+    module                 = config.wsgi:application
+    DJANGO_SETTINGS_MODULE = config.settings.base
+    http                   = 0.0.0.0:8000
+    processes              = 8
+    master                 = true
+    vacuum                 = true
+    enable-threads         = true
+    buffer-size            = 65535
+    stats                  = :3031
+    stats-http             = true
+    memory-report          = true
+    lazy-apps              = true
+    listen                 = 1024
+    disable-write-exception= 0
+    harakiri               = 300
+    socket-timeout         = 300
+    chunked-input-timeout  = 300
+    http-timeout           = 300
+    worker-reload-mercy    = 240
+    mule-reload-mercy      = 240

apps/pm/wb/backend.yaml

@@ -0,0 +1,153 @@
+---
+# ENV-файл env-file (secret sarex-env, ключ .env) содержит остальные секреты
+# приложения (DB/S3/Kafka и т.п.) — в дампе кластера Secret'ы не выгружены,
+# сам файл-секрет должен уже существовать в неймспейсе pm.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: backend
+  namespace: pm
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      backend:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/pm-backend:production_fa0f1551
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: backend
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: backend-service
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 8000
+
+          targetPort:
+            _default: 8000
+
+          portName:
+            _default: http
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: uwsgi-configmap
+              mountPath:
+                _default: /opt/sarex/uwsgi.ini
+              subPath:
+                _default: uwsgi.ini
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: backend-configmap
+                items:
+                  - key: uwsgi.ini
+                    path:
+                      _default: uwsgi.ini
+
+            - name: env-file
+              mountPath:
+                _default: /opt/sarex/.env
+              subPath:
+                _default: .env
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: sarex-env
+                items:
+                  - key: .env
+                    path:
+                      _default: .env
+
+            - name: kafka-cert-volume
+              mountPath:
+                _default: /usr/local/share/ca-certificates
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: kafka-cert
+
+        envs:
+          - name: USERS_INTERNAL_HOST
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+          - name: RESOURCES_INTERNAL_HOST
+            value:
+              _default: "http://resources-service.resources.svc.cluster.local:8000"
+
+          - name: EAV_HOST
+            value:
+              _default: "http://eav-service.eav.svc.cluster.local:8000"
+
+          - name: EAV_API_PREFIX
+            value:
+              _default: "/api/v0"
+
+          - name: EAV_API_PREFIX_V1
+            value:
+              _default: "/api/v1"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/pm/wb/celery.yaml

@@ -0,0 +1,146 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: celery
+  namespace: pm
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      celery:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/pm-backend:production_fa0f1551
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: celery
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 8000
+
+          command:
+            _default: ["celery", "-A", "config", "worker", "-B", "-l", "info", "-E", "-Q", "pm", "-n", "default_worker.%h", "--concurrency=2"]
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: false
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        volumes:
+          _default:
+            - name: uwsgi-configmap
+              mountPath:
+                _default: /opt/sarex/uwsgi.ini
+              subPath:
+                _default: uwsgi.ini
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: backend-configmap
+                items:
+                  - key: uwsgi.ini
+                    path:
+                      _default: uwsgi.ini
+
+            - name: env-file
+              mountPath:
+                _default: /opt/sarex/.env
+              subPath:
+                _default: .env
+              readOnly:
+                _default: true
+              secret:
+                secretName:
+                  _default: sarex-env
+                items:
+                  - key: .env
+                    path:
+                      _default: .env
+
+            - name: kafka-cert-volume
+              mountPath:
+                _default: /usr/local/share/ca-certificates
+              readOnly:
+                _default: true
+              configMap:
+                name:
+                  _default: kafka-cert
+
+        envs:
+          - name: PLANNING_HOST
+            value:
+              _default: "http://backend-service.pm.svc.cluster.local:8000/api/pm/msp"
+
+          - name: PLANNING_USE
+            value:
+              _default: "True"
+
+          - name: USERS_INTERNAL_HOST
+            value:
+              _default: "http://backend.django.svc.cluster.local:8000"
+
+          - name: RESOURCES_INTERNAL_HOST
+            value:
+              _default: "http://resources-service.resources.svc.cluster.local:8000"
+
+          - name: EAV_HOST
+            value:
+              _default: "http://eav-service.eav.svc.cluster.local:8000"
+
+          - name: EAV_API_PREFIX
+            value:
+              _default: "/api/v0"
+
+          - name: EAV_API_PREFIX_V1
+            value:
+              _default: "/api/v1"
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/pm/wb/kafka-cert-configmap.yaml

@@ -0,0 +1,38 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kafka-cert
+  namespace: pm
+data:
+  kafka.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIIFLTCCAxWgAwIBAgIUYDZPxGRsr7IiqHEmfd07QTQlOKYwDQYJKoZIhvcNAQEN
+    BQAwLTETMBEGA1UECgwKaW8uc3RyaW16aTEWMBQGA1UEAwwNY2x1c3Rlci1jYSB2
+    MDAeFw0yNTEyMTYxNDM0NTVaFw0yNjEyMTYxNDM0NTVaMC0xEzARBgNVBAoMCmlv
+    LnN0cmltemkxFjAUBgNVBAMMDWNsdXN0ZXItY2EgdjAwggIiMA0GCSqGSIb3DQEB
+    AQUAA4ICDwAwggIKAoICAQCfzDZhEzw2pbU5Xpu8OzD+3iQG+DVjU8PQWWQEF27h
+    yjohDkUr3zCZtW7xMKWKUNxBgrKsfe4TDOQN8cij3cS9sy0So+UhMeF7Bq9PU1Yd
+    bmTRq8q1PiuNUkiCGJ5wrb3+NZvVxZLJUIFgiealsRw80MgMWWSzy0I35T2Edn/a
+    DU4jhlgQxyzQ621+oGP0n28gCjmm6pCq2tkj/Z8WTdu1gOWyRdK02a2uE2Ts2nLa
+    Di32GaZrIbIuD/WUd6Ek66uCeJvh2CT7s+SqgtMbtT7gibUuPQ3hk1VGQsjy22l3
+    hUNpLu86nrwbuf21mY55KnLOcaVq1ag1TpIIKfZAL/KWFCGZ6H6kwEIbCAL0Hei7
+    cJ2Wm2/qlzKUeU869M7YybZAfXl/t6XT4QgFgje+42N980vy5A4GhWi1Z7lPqqOe
+    jPGBstkRZybKz1sTk87+oJx82iQU/ozVmzjSEK1SoYRNbvug8PNpxmPoPnJ2flgG
+    t2q2+2ZQP3f1aAHVcZ3U5+hWlRmKPXzjrJv7gnhuvqJl7OwB50y+yWiVfZ9xrYl2
+    EpX+yHuFFK+9NnB5taUK8Fz+hQaLU8J4q7P0bRqkoI+LdcEErjuDT/eI2d5+Ql8K
+    /JkV823hX2WNB9bdaQ24BelVUbsxGpR7ms6KWrM11kHnbzUlEM+AxZES6F7Qbr55
+    TwIDAQABo0UwQzAdBgNVHQ4EFgQUM7hshx7e9TFEN82Pf446aBrJUA4wEgYDVR0T
+    AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQENBQADggIB
+    AFNHFGPDxY966fz0dxDFFSfeo47y7XQZMK9xAwH73cQoSeqx+IMxzgM8nfJQ9XMN
+    PeLwVRZ7pvRee2ZhUPglBSTHnW2rvfmLBOO9xyKZxRsCkoFxuHH9xfM7bFWb96R6
+    fGrOdEZDB3yj00T+tkubwqt+/dUhQUj8juwyPs55WMb/0BIbapaoQ6QOP13CaXDV
+    ZmAfsEEIBkNxfq7GTr/z0Rq0B4+9FxAf3Jrsmi/dYoFD/prHsvBDkYw1daoFyp5C
+    tbctvB9wtphnCCynekt8UBvpVKHUU/xaUa09TQTToXjBbV1SZeIOHNG0MNbWa4sz
+    AL/cpXdq1EAxiTeAVT9XhCwhe/xJvFZIWuFLmW3J+ZxrOUCKieCYpTqBY2tBkkDY
+    //egic787yTR6zxqQNSzvNU5LhzrN7lu+KHGM06T35+HvpzgPPiRCzsxO62p63op
+    mq04K31yYZgLiqeAj5W+rioRGJNn4TXJpH9KIrzmGM7lVWLYWMAKeZU4r1lDUdcu
+    7jsBH8BRJWJeVK3xVw2HB3lk7Xn0WrR92adeYQ3f0vKbMIAVUnSJ3yCKJ4NMFSki
+    j78nx2mi/G0RhUPGZ9hhLXQKj9BtbpEnwpbGWtf0ShtVOxD/HKLCr7koBtW9TMPS
+    9K0sJhE5VjsQLkDDu9p3GdRcuLNA/oa7xFvRFtqGFsLj
+    -----END CERTIFICATE-----

apps/pm/wb/kustomization.yaml

@@ -0,0 +1,10 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: pm
+resources:
+  - backend-configmap.yaml
+  - kafka-cert-configmap.yaml
+  - backend.yaml
+  - celery.yaml
+  - redis.yaml

apps/pm/wb/redis.yaml

@@ -0,0 +1,88 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: redis
+  namespace: pm
+
+spec:
+  interval: 10m
+
+  chart:
+    spec:
+      chart: universal-chart
+      version: "0.1.7"
+      sourceRef:
+        kind: HelmRepository
+        name: yc-oci-charts
+        namespace: flux-system
+      interval: 10m
+
+  install:
+    remediation:
+      retries: 3
+
+  upgrade:
+    remediation:
+      retries: 3
+
+  values:
+    global:
+      env: _default
+
+    services:
+      redis:
+        enabled: true
+
+        image:
+          name:
+            _default: cr.yandex/crp3ccidau046kdj8g9q/redis:latest
+          pullPolicy:
+            _default: IfNotPresent
+
+        deployment:
+          enabled: true
+
+          name:
+            _default: redis
+
+          replicaCount:
+            _default: 1
+
+          port:
+            _default: 6379
+
+          probes:
+            liveness:
+              enabled: false
+            readiness:
+              enabled: false
+
+        service:
+          enabled: true
+
+          name:
+            _default: redis
+
+          type:
+            _default: ClusterIP
+
+          port:
+            _default: 6379
+
+          targetPort:
+            _default: 6379
+
+          portName:
+            _default: tcp
+
+        imagePullSecrets:
+          enabled:
+            _default: true
+          name:
+            _default: dockerhub
+
+        commitSha: ""
+        gitlabUri: ""
+        gitlabJobUrl: ""
+        owner: ""

apps/processing/aero/kustomization.yaml

@@ -1,309 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: processing
-resources:
-  - ../base
-
-patches:
-  # --- Состав: только api и engine-low ---------------------------------------
-  # engine удалён: в base у него replicaCount 0, то есть он и там выключен, а
-  # образ прибит к тегу с опечаткой в имени (workflows-endigne_prod). Рабочий
-  # обработчик — engine-low, он же на более свежем образе contour_*.
-  - target: {kind: HelmRelease, name: engine}
-    patch: |
-      $patch: delete
-      apiVersion: helm.toolkit.fluxcd.io/v2
-      kind: HelmRelease
-      metadata:
-        name: engine
-        namespace: processing
-
-  # frontend идёт из base без патчей. Адреса бэкендов вшиты в бандл на этапе
-  # сборки (константа __BUILD_ENV__), но сборка ugok2 обращается к тому же
-  # origin относительными путями — иначе в остальных кластерах не понадобился
-  # бы отдельный маршрут /workflows/api/ перед /workflows/. Поэтому фронтенд
-  # публикуется на домене платформы, а не на своём поддомене: маршруты в
-  # infrastructure/istio-config/aero, VirtualService platform.
-
-  # --- workflows-api ----------------------------------------------------------
-  - target: {kind: HelmRelease, name: workflows-api}
-    patch: |
-      # S3 приезжает из Vault отдельным ФАЙЛОМ, а не парой переменных:
-      # приложение читает по этому пути целый JSON. В base путь ведёт в
-      # /etc/sarex/yc-s3/, куда в контуре ничего не смонтировано.
-      - op: test
-        path: /spec/values/services/backend/envs/3/name
-        value: S3_SERVICE_ACCOUNT
-      - op: replace
-        path: /spec/values/services/backend/envs/3/value/_default
-        value: /vault/secrets/processing-s3
-      - op: add
-        path: /spec/values/services/backend/podAnnotations/_default/vault.hashicorp.com~1agent-inject-secret-processing-s3
-        value: secrets/data/minio/apps/processing
-      - op: add
-        path: /spec/values/services/backend/podAnnotations/_default/vault.hashicorp.com~1agent-inject-template-processing-s3
-        value: |-
-          {{- with secret "secrets/data/minio/apps/processing" -}}
-          {
-            "host": "{{ index .Data.data "host" }}",
-            "bucket": "{{ index .Data.data "bucket" }}",
-            "access_key_id": "{{ index .Data.data "access_key_id" }}",
-            "secret_access_key": "{{ index .Data.data "secret_access_key" }}",
-            "region": "{{ index .Data.data "region" }}",
-            "verify": false
-          }
-          {{- end -}}
-
-  # --- engine-low -------------------------------------------------------------
-  # Патчи адресуются по индексу, поэтому перед каждым replace идёт op: test на
-  # имя переменной. Если в base порядок envs изменится, сборка упадёт явно,
-  # вместо того чтобы молча перезаписать соседнее значение.
-  - target: {kind: HelmRelease, name: engine-low}
-    patch: |
-      # Sentry — внешний домен, из контура недостижим. Значение прокидывается
-      # ещё и в каждый под задачи, поэтому зануляем в одном месте.
-      - op: test
-        path: /spec/values/services/backend/envs/2/name
-        value: WORKFLOWS_SENTRY_DSN
-      - op: replace
-        path: /spec/values/services/backend/envs/2/value/_default
-        value: ""
-
-      # В base адрес django неверный даже для кластеров, где он есть: сервис
-      # называется backend-svc и слушает 80, а не backend:8000. У api то же
-      # значение уже правильное.
-      - op: test
-        path: /spec/values/services/backend/envs/5/name
-        value: DJANGO_HOST
-      - op: replace
-        path: /spec/values/services/backend/envs/5/value/_default
-        value: http://backend-svc.django.svc.cluster.local:80
-
-      # S3 — как у api выше.
-      - op: test
-        path: /spec/values/services/backend/envs/6/name
-        value: S3_SERVICE_ACCOUNT
-      - op: replace
-        path: /spec/values/services/backend/envs/6/value/_default
-        value: /vault/secrets/processing-s3
-
-      # SMTP выключаем целиком: почтового релея в контуре нет. Вместе с флагом
-      # убираем аннотацию инжекции secrets/vault/common/smtp_auth — секрета в
-      # Vault нет, а vault-agent-init на несуществующем секрете не отрендерит
-      # шаблон и оставит под в Init:Error, до флага дело не дойдёт.
-      - op: test
-        path: /spec/values/services/backend/envs/23/name
-        value: ENABLE_SMTP
-      - op: replace
-        path: /spec/values/services/backend/envs/23/value/_default
-        value: "0"
-      - op: remove
-        path: /spec/values/services/backend/podAnnotations/_default/vault.hashicorp.com~1agent-inject-secret-processing-smtp
-      - op: remove
-        path: /spec/values/services/backend/podAnnotations/_default/vault.hashicorp.com~1agent-inject-template-processing-smtp
-
-      # Смежные сервисы, которых в контуре нет: documentations (PDM,
-      # filestream), resources, bim-api, workspace, issues, comparisons,
-      # mailgun. Оставляем только S3 — единственное внешнее хранилище, которое
-      # в aero действительно есть.
-      - op: test
-        path: /spec/values/services/backend/envs/22/name
-        value: ENABLE_PDM_STORAGE
-      - op: replace
-        path: /spec/values/services/backend/envs/22/value/_default
-        value: "0"
-      - op: test
-        path: /spec/values/services/backend/envs/26/name
-        value: ENABLE_BIM_API_V2_DB
-      - op: replace
-        path: /spec/values/services/backend/envs/26/value/_default
-        value: "0"
-      - op: test
-        path: /spec/values/services/backend/envs/27/name
-        value: ENABLE_WORKSPACE_API_DB
-      - op: replace
-        path: /spec/values/services/backend/envs/27/value/_default
-        value: "0"
-      - op: test
-        path: /spec/values/services/backend/envs/28/name
-        value: ENABLE_ISSUE_API_DB
-      - op: replace
-        path: /spec/values/services/backend/envs/28/value/_default
-        value: "0"
-      - op: test
-        path: /spec/values/services/backend/envs/29/name
-        value: ENABLE_RESOURCES_API
-      - op: replace
-        path: /spec/values/services/backend/envs/29/value/_default
-        value: "0"
-      - op: test
-        path: /spec/values/services/backend/envs/31/name
-        value: ENABLE_PDM_API_DB
-      - op: replace
-        path: /spec/values/services/backend/envs/31/value/_default
-        value: "0"
-      - op: test
-        path: /spec/values/services/backend/envs/32/name
-        value: ENABLE_COMPARISONS_API_DB
-      - op: replace
-        path: /spec/values/services/backend/envs/32/value/_default
-        value: "0"
-      - op: test
-        path: /spec/values/services/backend/envs/33/name
-        value: ENABLE_MAIL_GUN
-      - op: replace
-        path: /spec/values/services/backend/envs/33/value/_default
-        value: "0"
-
-      # Планирование подов задач. engine работает kubernetes-исполнителем и сам
-      # создаёт Job'ы, подставляя им nodeSelector dedicated=processing и
-      # соответствующий toleration. Выделенных нод в контуре нет — все три
-      # равнозначны, — поэтому поды задач висли бы в Pending с
-      #   didn't match Pod's node affinity/selector
-      # ровно как это было у postgresql (см. postRenderers в его релизе).
-      #
-      # ENABLE_TOLERATION ЗДЕСЬ НЕ ВЫКЛЮЧАТЬ. Сначала я поставил его в "0" — и
-      # это тихо сломало запуск задач совсем: в движке классы ресурсов
-      # регистрируются ПОД ЭТИМ ЖЕ ФЛАГОМ,
-      #   if resCfg.EnableToleration { services[HighResources] = ... }
-      # (pkg/kube_services/services.go), поэтому задача с service_request
-      # "high-resources" падала не на планировании, а раньше — на разборе:
-      #   ERROR create k8s job: create k8s job: unknown service
-      # Ни одного пода при этом не создавалось, и в логе не было ни слова про
-      # nodeSelector, так что связь с этим флагом неочевидна.
-      #
-      # Вместо выключения переводим селектор на метку, которая есть на всех
-      # нодах, — kubernetes.io/os=linux. Класс сервисов остаётся
-      # зарегистрированным, nodeSelector совпадает с любой нодой, а toleration
-      # на несуществующий taint безвреден. Запрашиваемые ресурсы трогать не
-      # надо: в base это 1 CPU и 1Gi.
-      #
-      # IGNORE_TAINTS_AND_NODE_SELECTOR (появился в base из master) полагаться
-      # на него не стоит: в master workflows-engine такой переменной нет. Образ
-      # при этом contour_a03d37da-dirty2 — ручная сборка, поднятая тем же
-      # коммитом master, что добавил переменную, так что она там, вероятно,
-      # поддержана. Проверить нечем, поэтому селектор задан явно, а не через
-      # неё; вреда от того, что она выставлена в base, нет.
-      - op: test
-        path: /spec/values/services/backend/envs/53/name
-        value: TOLERATION_KEY
-      - op: replace
-        path: /spec/values/services/backend/envs/53/value/_default
-        value: kubernetes.io/os
-      - op: test
-        path: /spec/values/services/backend/envs/54/name
-        value: TOLERATION_VALUE
-      - op: replace
-        path: /spec/values/services/backend/envs/54/value/_default
-        value: linux
-      - op: test
-        path: /spec/values/services/backend/envs/55/name
-        value: TOLERATION_KEY_HIGH_MEM
-      - op: replace
-        path: /spec/values/services/backend/envs/55/value/_default
-        value: kubernetes.io/os
-      - op: test
-        path: /spec/values/services/backend/envs/56/name
-        value: TOLERATION_VALUE_HIGH_MEM
-      - op: replace
-        path: /spec/values/services/backend/envs/56/value/_default
-        value: linux
-      - op: test
-        path: /spec/values/services/backend/envs/57/name
-        value: TOLERATION_KEY_PERSISTENT
-      - op: replace
-        path: /spec/values/services/backend/envs/57/value/_default
-        value: kubernetes.io/os
-      - op: test
-        path: /spec/values/services/backend/envs/58/name
-        value: TOLERATION_VALUE_PERSISTENT
-      - op: replace
-        path: /spec/values/services/backend/envs/58/value/_default
-        value: linux
-      - op: test
-        path: /spec/values/services/backend/envs/70/name
-        value: DEFAULT_NODE_SELECTOR_KEY
-      - op: replace
-        path: /spec/values/services/backend/envs/70/value/_default
-        value: kubernetes.io/os
-      - op: test
-        path: /spec/values/services/backend/envs/71/name
-        value: DEFAULT_NODE_SELECTOR_VALUE
-      - op: replace
-        path: /spec/values/services/backend/envs/71/value/_default
-        value: linux
-
-      # --- Vault для ПОДОВ ЗАДАЧ, а не для самого движка ----------------------
-      # В сборке contour_a03d37da-dirty2 движок умеет не монтировать в Job
-      # готовый Secret, а вешать на него аннотации vault-agent — тогда файл
-      # с кредами кладёт агент, и Secret в namespace задач не нужен вовсе.
-      # Именно так это работает в UGMK, где никакого yc-s3 в namespace нет.
-      #
-      # В master workflows-engine этого кода нет (сборка с невлитой ветки),
-      # поэтому набор переменных восстановлен по строкам бинарника:
-      #   VAULT_ROLE, VAULT_SA, VAULT_MOUNT_PATH
-      #   vault.hashicorp.com/{role,secret-volume-path,agent-inject-file-*,
-      #                        agent-inject-secret-*,agent-inject-template-*}
-      #   yc-s3, yc-s3-service-account.json, /etc/sarex/yc-s3
-      #
-      # В base задан только VAULT_USE=true — остальных трёх нет НИ В ОДНОМ
-      # кластере репозитория, поэтому аннотации выходили неполными, агент в под
-      # задачи ничего не клал, и файл читался как пустой:
-      #   ValueError: SERVICE_S3 is not valid
-      #   Expecting value: line 1 column 1 (char 0)
-      #
-      # Переменных нет в base, поэтому op: add с "-" (добавление в конец
-      # списка), а не replace по индексу.
-      - op: add
-        path: /spec/values/services/backend/envs/-
-        value:
-          name: VAULT_ROLE
-          value:
-            _default: processing
-      - op: add
-        path: /spec/values/services/backend/envs/-
-        value:
-          name: VAULT_SA
-          value:
-            _default: processing-vault
-      # VAULT_MOUNT_PATH — вопреки имени НЕ корень KV, а ПОЛНЫЙ путь секрета:
-      # движок подставляет значение в шаблон целиком. Проверено по аннотациям
-      # созданного пода задачи:
-      #   agent-inject-secret-yc-s3: <VAULT_MOUNT_PATH>
-      #   agent-inject-template-yc-s3:
-      #     {{- with secret "<VAULT_MOUNT_PATH>" -}}
-      #     {{ index .Data.data "yc-s3-service-account.json" }}
-      # Отсюда два следствия: путь пишется в форме чтения KV v2 (с /data/), а в
-      # секрете обязан быть ключ с именем ФАЙЛА.
-      #
-      # Путь ОДИН НА ВСЕ ФАЙЛЫ, которые движок кладёт в поды задач: он
-      # подставляет VAULT_MOUNT_PATH в каждую аннотацию, меняя только имя
-      # ключа. Так, для django-auth аннотация ссылается на этот же путь и ищет
-      # в нём ключ django-auth.json. Поэтому имя пути нейтральное (job-files),
-      # а не по имени одного из файлов, — иначе оно врёт о содержимом.
-      # Сам секрет кладёт ansible, vault_app_secrets.
-      - op: add
-        path: /spec/values/services/backend/envs/-
-        value:
-          name: VAULT_MOUNT_PATH
-          value:
-            _default: secrets/data/apps/processing/job-files
-
-      # S3 из Vault, как у api.
-      - op: add
-        path: /spec/values/services/backend/podAnnotations/_default/vault.hashicorp.com~1agent-inject-secret-processing-s3
-        value: secrets/data/minio/apps/processing
-      - op: add
-        path: /spec/values/services/backend/podAnnotations/_default/vault.hashicorp.com~1agent-inject-template-processing-s3
-        value: |-
-          {{- with secret "secrets/data/minio/apps/processing" -}}
-          {
-            "host": "{{ index .Data.data "host" }}",
-            "bucket": "{{ index .Data.data "bucket" }}",
-            "access_key_id": "{{ index .Data.data "access_key_id" }}",
-            "secret_access_key": "{{ index .Data.data "secret_access_key" }}",
-            "region": "{{ index .Data.data "region" }}",
-            "verify": false
-          }
-          {{- end -}}