Добавлены скрипты для полного рендера манифестов и точка входа образа.

Здесь остаётся только то, что читает Flux: clusters/, infrastructure/, apps/.
Ansible-роли, docker-compose подложки (k3s, gitea, vault, bootstrap Flux),
конфигурация Vault и k3s-манифесты DNS-мостов переехали в отдельный
репозиторий — их читает не кластер, а ansible с control-node, и держать их
рядом с манифестами было незачем.

Заодно уехали postgres/initdb и frontend/Dockerfile — остатки прикладного
compose-стека, убранного в 75d1fba. На них уже никто не ссылался.

Связь остаётся односторонней: роль sarex_stack пакует отсюда clusters/aero и
его замыкание и коммитит в gitea контура. Путь сюда она берёт из flux_src_root
(по умолчанию соседний каталог ../iac). Добавили компонент в
clusters/aero/controllers — допишите его в gitea_sync_paths в aero-deploy,
иначе kustomize в кластере упадёт на отсутствующем каталоге; обратной ссылки
из кода нет, поэтому напоминание продублировано в README.

Каждый удалённый файл предварительно сверен по sha256 с копией в aero-deploy:
49 совпали побайтово, 5 отличаются осознанными правками переноса.

.dockerignore

@@ -0,0 +1,25 @@
+# В контекст сборки нужны только манифесты: clusters/, apps/, infrastructure/
+# и скрипты из hack/. Всё остальное — история, IDE, секреты — только раздувает
+# контекст и рискует уехать в образ.
+.git
+.gitignore
+.idea
+.claude
+CLAUDE.md
+.env
+.env.*
+docs
+*.md
+aero
+inventory.yaml
+tmp
+.tmp/
+snapshots
+out
+
+# Секреты и ключи не должны попадать в контекст сборки даже случайно.
+*.pem
+*.key
+*.p12
+kubeconfig*
+*service-account*.json

.gitignore

@@ -2,9 +2,20 @@
 .claude
 CLAUDE.md
 .env
+.env.*
 
 tmp
 .tmp/
 snapshots/*
-scripts/.venv
+
-scripts
+# Рантайм-артефакты контура aero (gitea-data, k3s-storage, ключи реестра)
+# переехали в infra/aero-deploy вместе с docker-compose, который их создаёт.
+# Здесь остаётся только gitea-data: каталог мог остаться от прежней раскладки.
+gitea-data/
+
+# --- Секреты и ключи: не коммитить никогда ---
+*.pem
+*.key
+*.p12
+kubeconfig*
+*service-account*.json

Dockerfile

@@ -0,0 +1,77 @@
+# Полная сборка манифестов IaC-репозитория для одного контура.
+#
+#   docker build --build-arg CONTOUR=aero -t iac:aero .
+#   docker run --rm iac:aero list                  # что собралось
+#   docker run --rm iac:aero cat clusters          # слои Flux одним потоком
+#   docker run --rm -v "$PWD/out:/export" iac:aero export
+#
+# Контур — имя каталога в clusters/ (aero, brusnika-prod, dsinv, wb, ...).
+# Тот же идентификатор служит именем overlay внутри apps/* и infrastructure/*,
+# поэтому одного аргумента хватает на весь рендер.
+#
+# Сборка офлайновая: kustomize build разворачивает оверлеи и патчи, а
+# HelmRelease остаётся Custom Resource'ом — чарты тянет Flux уже в кластере.
+# Ни helm, ни доступ к OCI-реестру здесь не нужны. Исключение — валидация:
+# схемы CRD kubeconform берёт из сети (отключается VALIDATE=0).
+
+ARG KUSTOMIZE_VERSION=v5.4.3
+ARG KUBECONFORM_VERSION=v0.6.7
+
+FROM registry.k8s.io/kustomize/kustomize:${KUSTOMIZE_VERSION} AS kustomize
+FROM ghcr.io/yannh/kubeconform:${KUBECONFORM_VERSION} AS kubeconform
+
+
+FROM alpine:3.20 AS builder
+
+# Контур обязателен по смыслу, но значение по умолчанию оставлено: сборка без
+# --build-arg собирает aero, а не падает на пустой переменной.
+ARG CONTOUR=aero
+ARG VALIDATE=1
+ARG KUBERNETES_VERSION=1.30.0
+
+COPY --from=kustomize /app/kustomize /usr/local/bin/kustomize
+COPY --from=kubeconform /kubeconform /usr/local/bin/kubeconform
+
+WORKDIR /src
+
+# Скрипт копируется отдельным слоем: правка манифестов не инвалидирует его,
+# а правка скрипта не тянет за собой пересборку базовых слоёв.
+COPY hack/render-contour.sh /usr/local/bin/render-contour
+RUN chmod +x /usr/local/bin/render-contour
+
+COPY . .
+
+RUN render-contour "${CONTOUR}" /out
+
+# Валидация отдельным слоем: смена версии Kubernetes не пересобирает рендер.
+# --ignore-missing-schemas пропускает ресурсы, чьих схем нет в каталоге
+# (часть CRD), но не заглушает ошибки в тех, что нашлись.
+RUN if [ "${VALIDATE}" = "1" ]; then \
+      kubeconform \
+        -kubernetes-version "${KUBERNETES_VERSION}" \
+        -strict \
+        -ignore-missing-schemas \
+        -schema-location default \
+        -schema-location 'https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json' \
+        -summary \
+        /out/*.yaml ; \
+    else \
+      echo "VALIDATE=0 — проверка схемами пропущена" ; \
+    fi
+
+
+FROM alpine:3.20
+
+ARG CONTOUR=aero
+ENV CONTOUR=${CONTOUR}
+
+LABEL org.opencontainers.image.title="iac-manifests" \
+      org.opencontainers.image.description="Собранные манифесты контура ${CONTOUR}" \
+      ru.iac.contour="${CONTOUR}"
+
+COPY --from=builder /out /manifests
+COPY hack/entrypoint.sh /usr/local/bin/entrypoint
+RUN chmod +x /usr/local/bin/entrypoint
+
+ENTRYPOINT ["/usr/local/bin/entrypoint"]
+CMD ["list"]

IAC-CATALOG.md

@@ -60,7 +60,7 @@ Superset, Trino, GoAlert, GlitchTip, argo-*, otel-*) **существуют об
 
 | Репозиторий | Зона ответственности | Ключевое содержимое |
 |---|---|---|
-| ★ [infra/iac](https://gitlab.sarex.io/infra/iac) ✅ | **Основной GitOps-монорепозиторий (Flux v2).** Декларативное состояние 9 кластеров: инфраструктурные компоненты + прикладные сервисы | `clusters/`, `infrastructure/` (36), `apps/` (37), `inventory.yaml`, `docs/apps/` |
+| ★ [infra/iac](https://gitlab.sarex.io/infra/iac) ✅ | **Основной GitOps-монорепозиторий (Flux v2).** Декларативное состояние 9 кластеров: инфраструктурные компоненты + прикладные сервисы. Только манифесты — развёртывание контура aero выделено в [infra/aero-deploy](https://gitlab.sarex.io/infra/aero-deploy) | `clusters/`, `infrastructure/` (36), `apps/` (37), `inventory.yaml`, `docs/apps/` |
 | [infra/terraform](https://gitlab.sarex.io/infra/terraform) ✅ | **Ресурсы Yandex Cloud и Kubernetes**: namespaces, PostgreSQL БД/пользователи, S3-бакеты, Valkey/Redis-пользователи, Kafka-топики, RabbitMQ, k8s-секреты. Единый источник правды — `infrastructure.yaml`, секреты через SOPS | `live/prod` (Terragrunt), `modules/`: `k8s-namespace`, `k8s-secret`, `k8s-secrets`, `kafka-topics-yc`, `rabbitmq`, `yc-database`, `yc-s3`, `yc-valkey-user` |
 | [infra/terraform-contour](https://gitlab.sarex.io/infra/terraform-contour) ✅ | Тот же подход **для изолированного контура**: namespaces и секреты из Vault | `live/{namespace,vault-secrets}`, `modules/{k8s-namespace,vault-platform-secrets}` |
 | [infra/terraform-contour-mirror](https://gitlab.sarex.io/infra/terraform-contour-mirror) ✅ | **Зеркало `infra/terraform` для контура** (ветка `contour`, единственная). Тот же README и структура + `Dockerfile` для запуска в закрытом периметре | `live/`, `modules/`, `scripts/`, `Dockerfile` |
@@ -74,6 +74,7 @@ Superset, Trino, GoAlert, GlitchTip, argo-*, otel-*) **существуют об
 
 | Репозиторий | Отвечает за |
 |---|---|
+| [infra/aero-deploy](https://gitlab.sarex.io/infra/aero-deploy) ✅ | **Изолированный контур aero на одном хосте**: ansible-роли (`base`, `docker`, `sarex_stack`) + `docker-compose.yaml` подложки — k3s тремя контейнерами, gitea как источник правды, Vault, bootstrap FluxCD. Манифесты берёт из `infra/iac` (`flux_src_root`) и синхронизирует в gitea контура. Выделен из `infra/iac` |
 | [infra/kubespray](https://gitlab.sarex.io/infra/kubespray) ✅ | Форк upstream Kubespray — **развёртывание самих кластеров Kubernetes** на VM |
 | [infra/k8s-provision](https://gitlab.sarex.io/infra/k8s-provision) ✅ | **Первичная обвязка свежего кластера**: `namespaces`, `cert_manager`, `istio` (+`ISTIO.md`), `ingress`, `dashboard`, `prometheus`, `postgres`/`ya_postgres`, `rabbitmq`, `pvc`, `gitlab`, `teamcity`, `migration` |
 | [infra/ansible-playbooks](https://gitlab.sarex.io/infra/ansible-playbooks) ✅ | Зонтичный Ansible-репозиторий: каталоги `minio/`, `patroni/` |

README.md

@@ -369,6 +369,23 @@ flowchart LR
 │       └── patches/                # Патчи поверх base
 ```
 
+### Чего здесь нет: развёртывание контура aero
+
+Машинерия подъёма самого хоста живёт в отдельном репозитории
+[`infra/aero-deploy`](https://gitlab.sarex.io/infra/aero-deploy): ansible-роли,
+`docker-compose.yaml` подложки (k3s, gitea, vault, bootstrap Flux),
+конфигурация Vault и k3s-манифесты DNS-мостов. Здесь остаётся только то, что
+раскатывает Flux.
+
+Связь между репозиториями односторонняя: роль `sarex_stack` пакует отсюда
+`clusters/aero` и его замыкание (переменная `gitea_sync_paths`) и коммитит в
+gitea внутри контура, откуда это читает Flux. Путь к этому репозиторию роль
+берёт из `flux_src_root`, по умолчанию — соседний каталог `../iac`.
+
+Практическое следствие: **добавили компонент в `clusters/aero/controllers` —
+допишите его в `gitea_sync_paths`** в `aero-deploy`, иначе kustomize в кластере
+упадёт на отсутствующем каталоге. Обратной ссылки нет, и забыть об этом легко.
+
 ## Как это работает
 
 Flux отслеживает директорию `clusters/<имя-кластера>/`. Каждый кластер содержит два Flux Kustomization CRD верхнего уровня:

apps/ams-sync/wb/patch.yaml

@@ -1,55 +0,0 @@
----
-# Патч для контура wb.
-#
-# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
-# поэтому здесь продублирован весь набор из apps/ams-sync/base/helmrelease.yaml.
-#
-# В base image-тег и USER_SERVER_HOST/AUTH_HOST зашиты под другого клиента
-# (sarex.ugok.lan, образ ams-sync:ugok) — для wb это srx.wb.ru.
-# secretEnvs (telegram/zitadel/kafka/db) не трогаем — они читаются из обычных
-# k8s Secret'ов (не vault-agent), которые в wb уже должны быть заведены отдельно.
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: ams-sync
-  namespace: ams-sync
-spec:
-  values:
-    services:
-      backend:
-        envs:
-          - name: AMS_SYNC_TOPIC
-            value:
-              _default: "ams-sync"
-
-          - name: ENVIRONMENT
-            value:
-              _default: "PRODUCTION"
-
-          - name: HOST_ORGANIZATION_ID
-            value:
-              _default: "368536846176636704"
-
-          - name: ALERT_ENABLED
-            value:
-              _default: "False"
-
-          - name: USER_SERVER_HOST
-            value:
-              _default: "https://srx.wb.ru"
-
-          - name: AUTH_HOST
-            value:
-              _default: "https://srx.wb.ru"
-
-          - name: VERIFY_USERS
-            value:
-              _default: "True"
-
-          - name: KAFKA_SECURITY_PROTOCOL
-            value:
-              _default: "SSL"
-
-          - name: KAFKA_SASL_MECHANISM
-            value:
-              _default: "SCRAM-SHA-512"

apps/attachments/wb/backend.yaml

@@ -1,154 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: attachments
-  namespace: attachments
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      attachments:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/att9:dev
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: attachments
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 8000
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: true
-
-          name:
-            _default: attachments-service
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 8000
-
-          targetPort:
-            _default: 8000
-
-          portName:
-            _default: http
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        volumes:
-          _default:
-            - name: yc-s3
-              mountPath:
-                _default: /etc/sarex/yc-s3-storage
-              readOnly:
-                _default: true
-              secret:
-                secretName:
-                  _default: yc-s3
-
-        envs:
-          - name: POSTGRES_POOL_SIZE
-            value:
-              _default: "10"
-
-          - name: API_ADDRESS
-            value:
-              _default: "0.0.0.0:8000"
-
-          - name: YANDEX_S3_ACCOUNT_PATH
-            value:
-              _default: "/etc/sarex/yc-s3-storage/yc-s3-service-account.json"
-
-          - name: BUCKET_NAME
-            value:
-              _default: "attachments-storage"
-
-          - name: DATABASE_SSL_MODE
-            value:
-              _default: "disable"
-
-          - name: YANDEX_S3_VERIFY
-            value:
-              _default: "false"
-
-          - name: YANDEX_S3_USE_SSL
-            value:
-              _default: "false"
-
-        secretEnvs:
-          - name: DATABASE_HOST
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "host"
-
-          - name: DATABASE_PORT
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "port"
-
-          - name: DATABASE_NAME
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "database"
-
-          - name: DATABASE_USER
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "username"
-
-          - name: DATABASE_PASSWORD
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "password"
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/attachments/wb/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: attachments
-resources:
-  - backend.yaml

apps/bim/aero/bim-api.yaml

@@ -0,0 +1,224 @@
+---
+# BIM API — приложение из aero/bimbackend (Python, api + worker).
+#
+# ЭТО НЕ ТО ЖЕ, ЧТО apps/bim/base. В base описан platform/bim-backend-v2 —
+# другой сервис, на Go, с единственным httpserver. Спутать их легко: ОБА
+# пушат в реестр один и тот же образ bim-api, и различаются только тегами и
+# содержимым. У bimbackend теги — полный SHA коммита (CI пушит
+# bim-api:${CI_COMMIT_SHA} с master), у bim-backend-v2 — contour_*.
+# Поэтому здесь ../base намеренно НЕ подключён.
+#
+# Манифесты обычные, а не HelmRelease с universal-chart: в репозитории этот
+# сервис так и описан (apps/bim/dsinv), своего чарта у него нет, и заводить
+# его ради контура значило бы поддерживать ещё одну сущность.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: bim-api-sa
+  namespace: bim
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: bim-api
+  namespace: bim
+  labels:
+    app: bim-api
+spec:
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app: bim-api
+  template:
+    metadata:
+      labels:
+        app: bim-api
+      annotations:
+        # Порт Vault исключён из перехвата sidecar'ом: сам Vault живёт вне
+        # кластера, и заворачивать обращения к нему в mesh незачем.
+        traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
+        vault.hashicorp.com/agent-init-first: "true"
+        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
+        vault.hashicorp.com/auth-path: auth/kubernetes
+        vault.hashicorp.com/role: bim
+        # БД. Имена переменных — DB_*, как их читает settings.py bimbackend,
+        # а не POSTGRES_*, как у остальных приложений контура.
+        vault.hashicorp.com/agent-inject-secret-bim-db: secrets/data/apps/bim/postgres
+        vault.hashicorp.com/agent-inject-template-bim-db: |-
+          {{- with secret "secrets/data/apps/bim/postgres" -}}
+          DB_HOST={{ index .Data.data "host" }}
+          DB_PORT={{ index .Data.data "port" }}
+          DB_USER={{ index .Data.data "username" }}
+          DB_PASSWORD={{ index .Data.data "password" }}
+          {{- end -}}
+        vault.hashicorp.com/agent-inject-secret-bim-rabbitmq: secrets/data/rabbitmq/apps/bim
+        vault.hashicorp.com/agent-inject-template-bim-rabbitmq: |-
+          {{- with secret "secrets/data/rabbitmq/apps/bim" -}}
+          RABBIT_USER={{ index .Data.data "username" }}
+          RABBIT_PASSWORD={{ index .Data.data "password" }}
+          {{- end -}}
+        vault.hashicorp.com/agent-inject-secret-bim-s3: secrets/data/minio/apps/bim
+        vault.hashicorp.com/agent-inject-template-bim-s3: |-
+          {{- with secret "secrets/data/minio/apps/bim" -}}
+          AWS_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
+          AWS_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
+          {{- end -}}
+        # Публичный ключ JWT отдаётся файлом. Оба флага аутентификации ниже
+        # выключены, то есть читаться он не должен, — но путь в переменной
+        # обязан существовать, иначе рискуем падением при импорте настроек.
+        vault.hashicorp.com/agent-inject-secret-jwt-public: secrets/data/vault/common/rsa_keys
+        vault.hashicorp.com/agent-inject-template-jwt-public: |-
+          {{- with secret "secrets/data/vault/common/rsa_keys" -}}
+          {{ index .Data.data "public_key" }}
+          {{- end -}}
+    spec:
+      serviceAccountName: bim-api-sa
+      imagePullSecrets:
+        - name: regcred
+      containers:
+        - name: bim-api
+          # Тег — полный SHA, как их пушит CI aero/bimbackend с master. Именно
+          # этот образ крутится в dsinv. contour_*-теги у образа bim-api брать
+          # НЕЛЬЗЯ: их собирает bim-backend-v2, это чужое приложение.
+          image: cr.yandex/crp3ccidau046kdj8g9q/bim-api:870965d1967cd761965029b0480884ab7fa7c951
+          imagePullPolicy: IfNotPresent
+          # Штатный entrypoint не умеет читать секреты из файлов, поэтому
+          # оборачиваем его: подгружаем отрендеренное vault-агентом и передаём
+          # управление. exec — чтобы приложение осталось процессом с PID 1 и
+          # корректно получало сигналы остановки.
+          command: ["/bin/sh", "-ec"]
+          args:
+            - |
+              set -a
+              [ -f /vault/secrets/bim-db ] && . /vault/secrets/bim-db
+              [ -f /vault/secrets/bim-rabbitmq ] && . /vault/secrets/bim-rabbitmq
+              [ -f /vault/secrets/bim-s3 ] && . /vault/secrets/bim-s3
+              set +a
+              exec ./entrypoint_api.sh
+          ports:
+            - containerPort: 5555
+              name: http
+              protocol: TCP
+            - containerPort: 9000
+              name: prom
+              protocol: TCP
+          env:
+            - name: JWT_PUBLIC_KEY_PATH
+              value: /vault/secrets/jwt-public
+            - name: FEATURE_ENABLE_JWT_AUTH
+              value: "false"
+            - name: FEATURE_ENABLE_SAREX_AUTH
+              value: "false"
+            - name: FEATURE_ENABLE_WORKSPACES
+              value: "true"
+            # Google-хранилища в контуре нет и не будет — флаг выключен.
+            # Том с ключом, который есть в dsinv, здесь не нужен, а сама
+            # переменная ниже нужна, см. комментарий к ней.
+            - name: FEATURE_ENABLE_GCLOUD
+              value: "false"
+            # Значение НЕ УДАЛЯТЬ, даже при выключенном флаге выше. settings.py
+            # делает check_settings(): проходит по всем ключам ENV_FIELDS и
+            # падает на первом же незаданном —
+            #   Exception: ENV_VARIABLE NOT SET: GOOGLE_APPLICATION_CREDENTIALS
+            # Флаги проверяются позже, до них дело не доходит. Файла по этому
+            # пути нет и не будет: при FEATURE_ENABLE_GCLOUD=false его никто не
+            # открывает, важно лишь наличие самой переменной.
+            - name: GOOGLE_APPLICATION_CREDENTIALS
+              value: /etc/sarex/google-storage/service_account.json
+            # ВНИМАНИЕ: S3 в этом приложении НЕ НАСТРАИВАЕТСЯ на MinIO.
+            # В storage/s3.py адрес зашит в код:
+            #   endpoint_url='https://storage.yandexcloud.net'
+            # переменной окружения для него нет. Из контура он недостижим,
+            # поэтому любые операции с файлами будут падать по таймауту —
+            # это принято осознанно, API и остальные эндпоинты живут.
+            # Починить можно только пересборкой образа с вынесенным endpoint
+            # либо переводом на BIM_CURRENT_STORAGE=local (тип есть в
+            # storage/storages.py).
+            - name: FEATURE_ENABLE_S3
+              value: "true"
+            - name: S3_BUCKET
+              value: sarex-media-storage
+            - name: BIM_CURRENT_STORAGE
+              value: s3
+            - name: AWS_DEFAULT_REGION
+              value: ru-central1
+            - name: FEATURE_ENABLE_PROCESSING
+              value: "1"
+            # Адреса смежных сервисов приведены к именам контура. В dsinv это
+            # workflows-service:8000 и workspaces-service:8000 — таких сервисов
+            # здесь нет, оба называются backend-svc и слушают 80.
+            - name: PROCESSING_API_URL
+              value: http://backend-svc.processing.svc.cluster.local:80/internal
+            - name: PROCESSING_C2M_VERSION
+              value: stable
+            - name: WORKSPACES_API_URL
+              value: http://backend-svc.workspaces.svc.cluster.local:80/internal
+            # Сервиса сравнений в контуре нет и не планируется, флага для его
+            # отключения приложение не предоставляет. Имя оставлено говорящим:
+            # в логах будет видно, куда именно оно не достучалось.
+            - name: COMPARATOR_API_URL
+              value: http://comparator-api-service.comparator.svc.cluster.local/internal
+            - name: BIM_API_EXTERNAL_HOST_SCHEMA
+              value: https
+            - name: BIM_API_EXTERNAL_HOST
+              value: bim.sarex.local.lonsdaleites.ru
+            - name: BIM_API_INTERNAL_HOST_SCHEMA
+              value: http
+            - name: BIM_API_INTERNAL_HOST
+              value: bim-api-service.bim.svc.cluster.local:5555
+            - name: WEBHOOK_URL
+              value: http://bim-api-service.bim.svc.cluster.local:5555
+            # Брокер общий, vhost по умолчанию. В dsinv vhost называется api,
+            # но в контуре отдельных vhost'ов нет — см. secrets/rabbitmq/*.
+            - name: RABBIT_HOST
+              value: rabbitmq.rabbitmq.svc.cluster.local:5672
+            - name: RABBIT_VHOST
+              value: "/"
+            - name: MESH_OPTIMIZER_PATH
+              value: gltfpack
+            - name: DEBUG
+              value: "0"
+            - name: STORAGE_SEGMENT
+              value: sarex-production-storage
+            - name: STORAGE_PROJECT
+              value: sarex-production
+            - name: TMP_DIR
+              value: /tmp
+            - name: prometheus_multiproc_dir
+              value: /tmp
+            - name: BUNDLE_VERSION
+              value: v1
+            - name: DISABLE_INSTANCING
+              value: "0"
+          resources:
+            requests:
+              cpu: 25m
+              memory: 200Mi
+          volumeMounts:
+            - mountPath: /tmp
+              name: tmp-volume
+      volumes:
+        - name: tmp-volume
+          emptyDir: {}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: bim-api-service
+  namespace: bim
+  labels:
+    app: bim-api
+spec:
+  # ClusterIP, а не NodePort с прибитым портом 31352, как в dsinv: наружу
+  # сервис выходит через общий Gateway и VirtualService контура, отдельный
+  # порт на нодах ему не нужен.
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 5555
+      targetPort: 5555
+      protocol: TCP
+  selector:
+    app: bim-api

apps/bim/aero/bim-worker.yaml

@@ -0,0 +1,157 @@
+---
+# Воркер bimbackend. Крутит тот же образ и те же настройки, что api, —
+# отличается только точкой входа (entrypoint_worker.sh) и отсутствием портов.
+# Обоснования переменных не дублирую, они в bim-api.yaml.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: bim-worker-sa
+  namespace: bim
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: bim-worker
+  namespace: bim
+  labels:
+    app: bim-worker
+spec:
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app: bim-worker
+  template:
+    metadata:
+      labels:
+        app: bim-worker
+      annotations:
+        traffic.sidecar.istio.io/excludeOutboundPorts: "8200"
+        vault.hashicorp.com/agent-init-first: "true"
+        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
+        vault.hashicorp.com/auth-path: auth/kubernetes
+        vault.hashicorp.com/role: bim
+        vault.hashicorp.com/agent-inject-secret-bim-db: secrets/data/apps/bim/postgres
+        vault.hashicorp.com/agent-inject-template-bim-db: |-
+          {{- with secret "secrets/data/apps/bim/postgres" -}}
+          DB_HOST={{ index .Data.data "host" }}
+          DB_PORT={{ index .Data.data "port" }}
+          DB_USER={{ index .Data.data "username" }}
+          DB_PASSWORD={{ index .Data.data "password" }}
+          {{- end -}}
+        vault.hashicorp.com/agent-inject-secret-bim-rabbitmq: secrets/data/rabbitmq/apps/bim
+        vault.hashicorp.com/agent-inject-template-bim-rabbitmq: |-
+          {{- with secret "secrets/data/rabbitmq/apps/bim" -}}
+          RABBIT_USER={{ index .Data.data "username" }}
+          RABBIT_PASSWORD={{ index .Data.data "password" }}
+          {{- end -}}
+        vault.hashicorp.com/agent-inject-secret-bim-s3: secrets/data/minio/apps/bim
+        vault.hashicorp.com/agent-inject-template-bim-s3: |-
+          {{- with secret "secrets/data/minio/apps/bim" -}}
+          AWS_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
+          AWS_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
+          {{- end -}}
+        vault.hashicorp.com/agent-inject-secret-jwt-public: secrets/data/vault/common/rsa_keys
+        vault.hashicorp.com/agent-inject-template-jwt-public: |-
+          {{- with secret "secrets/data/vault/common/rsa_keys" -}}
+          {{ index .Data.data "public_key" }}
+          {{- end -}}
+    spec:
+      serviceAccountName: bim-worker-sa
+      imagePullSecrets:
+        - name: regcred
+      containers:
+        - name: bim-worker
+          image: cr.yandex/crp3ccidau046kdj8g9q/bim-api:870965d1967cd761965029b0480884ab7fa7c951
+          imagePullPolicy: IfNotPresent
+          command: ["/bin/sh", "-ec"]
+          args:
+            - |
+              set -a
+              [ -f /vault/secrets/bim-db ] && . /vault/secrets/bim-db
+              [ -f /vault/secrets/bim-rabbitmq ] && . /vault/secrets/bim-rabbitmq
+              [ -f /vault/secrets/bim-s3 ] && . /vault/secrets/bim-s3
+              set +a
+              exec ./entrypoint_worker.sh
+          env:
+            - name: JWT_PUBLIC_KEY_PATH
+              value: /vault/secrets/jwt-public
+            - name: FEATURE_ENABLE_JWT_AUTH
+              value: "false"
+            - name: FEATURE_ENABLE_SAREX_AUTH
+              value: "false"
+            - name: FEATURE_ENABLE_WORKSPACES
+              value: "true"
+            - name: FEATURE_ENABLE_GCLOUD
+              value: "false"
+            # Значение НЕ УДАЛЯТЬ, даже при выключенном флаге выше. settings.py
+            # делает check_settings(): проходит по всем ключам ENV_FIELDS и
+            # падает на первом же незаданном —
+            #   Exception: ENV_VARIABLE NOT SET: GOOGLE_APPLICATION_CREDENTIALS
+            # Флаги проверяются позже, до них дело не доходит. Файла по этому
+            # пути нет и не будет: при FEATURE_ENABLE_GCLOUD=false его никто не
+            # открывает, важно лишь наличие самой переменной.
+            - name: GOOGLE_APPLICATION_CREDENTIALS
+              value: /etc/sarex/google-storage/service_account.json
+            - name: FEATURE_ENABLE_S3
+              value: "true"
+            - name: S3_BUCKET
+              value: sarex-media-storage
+            - name: BIM_CURRENT_STORAGE
+              value: s3
+            - name: AWS_DEFAULT_REGION
+              value: ru-central1
+            - name: FEATURE_ENABLE_PROCESSING
+              value: "1"
+            - name: PROCESSING_API_URL
+              value: http://backend-svc.processing.svc.cluster.local:80/internal
+            - name: PROCESSING_C2M_VERSION
+              value: stable
+            - name: WORKSPACES_API_URL
+              value: http://backend-svc.workspaces.svc.cluster.local:80/internal
+            - name: COMPARATOR_API_URL
+              value: http://comparator-api-service.comparator.svc.cluster.local/internal
+            - name: BIM_API_EXTERNAL_HOST_SCHEMA
+              value: https
+            - name: BIM_API_EXTERNAL_HOST
+              value: bim.sarex.local.lonsdaleites.ru
+            - name: BIM_API_INTERNAL_HOST_SCHEMA
+              value: http
+            - name: BIM_API_INTERNAL_HOST
+              value: bim-api-service.bim.svc.cluster.local:5555
+            - name: WEBHOOK_URL
+              value: http://bim-api-service.bim.svc.cluster.local:5555
+            # В dsinv у воркера здесь rabbitmq-service.bim:5672 — брокера в
+            # namespace bim нет ни там, ни здесь; у api в том же файле адрес
+            # другой и правильный. Ставим общий брокер контура.
+            - name: RABBIT_HOST
+              value: rabbitmq.rabbitmq.svc.cluster.local:5672
+            - name: RABBIT_VHOST
+              value: "/"
+            - name: MESH_OPTIMIZER_PATH
+              value: gltfpack
+            - name: DEBUG
+              value: "0"
+            - name: STORAGE_SEGMENT
+              value: sarex-production-storage
+            - name: STORAGE_PROJECT
+              value: sarex-production
+            - name: TMP_DIR
+              value: /tmp
+            - name: prometheus_multiproc_dir
+              value: /tmp
+            - name: BUNDLE_VERSION
+              value: v1
+            - name: DISABLE_INSTANCING
+              value: "0"
+          resources:
+            requests:
+              cpu: 25m
+              memory: 200Mi
+          volumeMounts:
+            - mountPath: /tmp
+              name: tmp-volume
+      volumes:
+        - name: tmp-volume
+          emptyDir: {}

apps/bim/aero/kustomization.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: bim
+# ../base НЕ подключён намеренно: там описан platform/bim-backend-v2 — другое
+# приложение, которое разворачивать в контуре не нужно. Подробности в шапке
+# bim-api.yaml.
+resources:
+  - namespace.yaml
+  - bim-api.yaml
+  - bim-worker.yaml

apps/bim/aero/namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: bim
+  labels:
+    istio-injection: enabled

apps/bim/wb/backend.yaml

@@ -1,222 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: backend
-  namespace: bim
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      backend:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/bim-backend-v2:donstroi1
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: backend
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 8000
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: true
-
-          name:
-            _default: backend-service
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 8000
-
-          targetPort:
-            _default: 8000
-
-          portName:
-            _default: http
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        envs:
-          - name: LAST_MASTER_BIM
-            value:
-              _default: "100000"
-
-          - name: LAST_MASTER_BIM_V3
-            value:
-              _default: "100000"
-
-          - name: LAST_SLAVE_1_BIM
-            value:
-              _default: "1000000"
-
-          - name: POSTGRES_ADDRESS
-            value:
-              _default: "sarex-vpsql-01.xc.wb.ru"
-
-          - name: POSTGRES_PORT
-            value:
-              _default: "6432"
-
-          - name: POSTGRES_DB
-            value:
-              _default: "bim_db"
-
-          - name: DB_CERT_PATH_2
-            value:
-              _default: "/root/yandex_pg.pem"
-
-          - name: POSTGRES_ADDRESS_2
-            value:
-              _default: "sarex-vpsql-01.xc.wb.ru"
-
-          - name: POSTGRES_PORT_2
-            value:
-              _default: "6432"
-
-          - name: POSTGRES_DB_2
-            value:
-              _default: "bim_db"
-
-          - name: DB_CERT_PATH_3
-            value:
-              _default: "/root/yandex_pg.pem"
-
-          - name: POSTGRES_ADDRESS_3
-            value:
-              _default: "sarex-vpsql-01.xc.wb.ru"
-
-          - name: POSTGRES_PORT_3
-            value:
-              _default: "6432"
-
-          - name: POSTGRES_DB_3
-            value:
-              _default: "bim_db"
-
-          - name: DB_CERT_PATH_4
-            value:
-              _default: "/root/yandex_pg.pem"
-
-          - name: POSTGRES_ADDRESS_4
-            value:
-              _default: "sarex-vpsql-01.xc.wb.ru"
-
-          - name: POSTGRES_PORT_4
-            value:
-              _default: "6432"
-
-          - name: POSTGRES_DB_4
-            value:
-              _default: "bim_db"
-
-          - name: POSTGRES_POOL_SIZE
-            value:
-              _default: "30"
-
-          - name: API_ADDRESS
-            value:
-              _default: "0.0.0.0:8000"
-
-          - name: DJANGO_HOST
-            value:
-              _default: "http://backend.django.svc.cluster.local:8000"
-
-          - name: ENABLE_SQL_QUERY
-            value:
-              _default: "0"
-
-          - name: ENABLE_SSL
-            value:
-              _default: "0"
-
-        secretEnvs:
-          - name: POSTGRES_USER
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "username"
-
-          - name: POSTGRES_PASSWORD
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "password"
-
-          - name: POSTGRES_USER_2
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "username"
-
-          - name: POSTGRES_PASSWORD_2
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "password"
-
-          - name: POSTGRES_USER_3
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "username"
-
-          - name: POSTGRES_PASSWORD_3
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "password"
-
-          - name: POSTGRES_USER_4
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "username"
-
-          - name: POSTGRES_PASSWORD_4
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "password"
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/checklists/wb/backend.yaml

@@ -1,145 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: checklists-backend
-  namespace: checklists
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      checklists-backend:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/checklists-backend:production_68f242cd
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: checklists-backend
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 80
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: true
-
-          name:
-            _default: checklists-backend-service
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 80
-
-          targetPort:
-            _default: 8000
-
-          portName:
-            _default: http
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        envs:
-          - name: HTTP_APP_HOST
-            value:
-              _default: "0.0.0.0"
-
-          - name: HTTP_APP_PORT
-            value:
-              _default: "8000"
-
-          - name: HTTP_APP_ROOT_PATH
-            value:
-              _default: "/checklists"
-
-          - name: HTTP_APP_WORKERS
-            value:
-              _default: "8"
-
-          - name: HTTP_APP_ADMIN_ENABLE
-            value:
-              _default: "true"
-
-          - name: DATABASE_HOST
-            value:
-              _default: "sarex-vpsql-01.xc.wb.ru"
-
-          - name: DATABASE_PORT
-            value:
-              _default: "5432"
-
-          - name: DATABASE_NAME
-            value:
-              _default: "checklists_db"
-
-          - name: JWT_AUTH_ENABLE
-            value:
-              _default: "true"
-
-          - name: DEBUG
-            value:
-              _default: "false"
-
-        secretEnvs:
-          - name: DATABASE_USER
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "user"
-
-          - name: DATABASE_PASSWORD
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "password"
-
-          - name: JWT_AUTH_PUBLIC_KEY
-            secretName:
-              _default: "jwt-secret"
-            secretKey: "public-key"
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/checklists/wb/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: checklists
-resources:
-  - backend.yaml

apps/comparisons/wb/backend.yaml

@@ -1,94 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: backend
-  namespace: comparisons
-spec:
-  values:
-    services:
-      backend:
-        envs:
-          - name: APP_NAME
-            value:
-              _default: "comparisons"
-
-          - name: APP_VERSION
-            value:
-              _default: "0.0.1"
-
-          - name: LOGGER_LOG_LEVEL
-            value:
-              _default: "info"
-
-          - name: DATABASE_NAME
-            value:
-              _default: "postgres"
-
-          - name: ENABLE_SSL
-            value:
-              _default: "false"
-
-          - name: POSTGRES_POOL_SIZE
-            value:
-              _default: "10"
-
-          - name: HTTP_PORT
-            value:
-              _default: "8000"
-
-          - name: DOCUMENTATIONS_INTERNAL_HOST
-            value:
-              _default: "http://documentations-service.documentations"
-
-          - name: DOCUMENTATIONS_EXTERNAL_HOST
-            value:
-              _default: "https://lk.srx.wb.ru:30443/documentations"
-
-          - name: DOCUMENTATION_FILESTREAM_URL
-            value:
-              _default: "http://backend-filestream-svc.documentations.svc.cluster.local/"
-
-          - name: WORKFLOWS_HOST
-            value:
-              _default: "http://workflows-service.workflow"
-
-          - name: WORKFLOWS_IMAGE_VERSION
-            value:
-              _default: "master"
-
-          - name: WORKFLOWS_DJANGO_HOST
-            value:
-              _default: "https://lk.srx.wb.ru:30443"
-
-          - name: WORKFLOWS_BIMV2_INTERNAL_HOST
-            value:
-              _default: "http://bim-backend-v2-service.bim-api"
-
-          - name: WORKSPACES_HOST
-            value:
-              _default: "http://workspaces-service.workspaces"
-
-          - name: EAV_HOST
-            value:
-              _default: "https://lk.srx.wb.ru:30443/eav"
-
-          - name: LAST_MASTER_BIM
-            value:
-              _default: "36311"
-
-          - name: LAST_SLAVE_1_BIM
-            value:
-              _default: "94015"
-
-          - name: LAST_SLAVE_2_BIM
-            value:
-              _default: "135771"
-
-          - name: ABAP_FIXED_CONC
-            value:
-              _default: "0"
-
-          - name: WORKFLOWS_CONFIG_FILEPATH
-            value:
-              _default: "/etc/app/tasks-execution-config.json"

apps/contracts/wb/backend.yaml

@@ -1,99 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: contracts
-  namespace: contracts
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      contracts:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/contracts:prod_d3bbd9fc
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: contracts
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 8080
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: true
-
-          name:
-            _default: contracts-service
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 8080
-
-          targetPort:
-            _default: 8080
-
-          portName:
-            _default: http
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        secretEnvs:
-          - name: DB_URL
-            secretName:
-              _default: "ya-pg-secret"
-            secretKey: "db_url"
-
-          - name: PUBLIC_KEY
-            secretName:
-              _default: "public-key"
-            secretKey: "key"
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/contracts/wb/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: contracts
-resources:
-  - backend.yaml

apps/django/aero/django-configmap.yaml

@@ -1,4 +1,25 @@
----
+# Копия django-configmap из base с заменой домена на домен контура.
+#
+# Патчем этого не сделать: все настройки лежат ОДНИМ значением data.production.py
+# (331 строка python), kustomize умеет заменить его только целиком. Ровно та же
+# причина, что у nginx-configmap.yaml рядом.
+#
+# ЧТО ИЗМЕНЕНО — две строки про домен sarex.contour.infra.sarex.tech,
+# принадлежащий ДРУГОМУ контуру:
+#
+#   HOST                  — по нему backend строит АБСОЛЮТНЫЕ ссылки на медиа.
+#                           Браузер получал
+#                             https://sarex.contour.infra.sarex.tech/media/state/previews/....png
+#                           и, разумеется, 404: чужой хост, наших файлов там нет.
+#   CSRF_TRUSTED_ORIGINS  — без нашего домена django отклонял бы POST-формы
+#                           админки с ошибкой проверки Referer.
+#
+# И один блок сверх того: CsrfExemptSessionAuthentication в
+# DEFAULT_AUTHENTICATION_CLASSES вместо штатного SessionAuthentication —
+# из-за него SPA получала 403 на любое удаление. Обоснование и цена решения
+# расписаны прямо над классом.
+#
+# Больше в файле ничего не менялось: сравнивать с base удобно обычным diff.
 apiVersion: v1
 kind: ConfigMap
 metadata:
@@ -6,17 +27,57 @@ metadata:
   namespace: django
 data:
   production.py: |
-
+    import ast
     import os
     from .base import *
     from logging.handlers import SysLogHandler
     from datetime import timedelta
 
+    def _load_env_file(path):
+        try:
+            with open(path, "r", encoding="utf-8") as f:
+                for raw_line in f:
+                    line = raw_line.strip()
+                    if not line or line.startswith("#") or "=" not in line:
+                        continue
+                    key, value = line.split("=", 1)
+                    key = key.strip()
+                    value = value.strip()
+                    if len(value) >= 2 and value[0] == value[-1] and value[0] in ("'", '"'):
+                        try:
+                            value = ast.literal_eval(value)
+                        except (ValueError, SyntaxError):
+                            value = value[1:-1]
+                    if key and key not in os.environ:
+                        os.environ[key] = value
+        except FileNotFoundError:
+            pass
+
+    def _read_secret_file(path, default=""):
+        try:
+            with open(path, "r", encoding="utf-8") as f:
+                return f.read().strip()
+        except FileNotFoundError:
+            return default
+
+    # Fallback for manage.py launched via `kubectl exec` (outside entrypoint),
+    # so Django can still read DB/JWT values from Vault-injected files.
+    _load_env_file("/vault/secrets/django-postgresql")
+    _load_env_file("/vault/secrets/django-rabbitmq")
+    _load_env_file("/vault/secrets/django-s3")
+    _load_env_file("/vault/secrets/django-kafka")
+    _load_env_file("/vault/secrets/django-common")
+
+    if not os.environ.get("JWT_PRIVATE_KEY"):
+        os.environ["JWT_PRIVATE_KEY"] = _read_secret_file("/vault/secrets/django-jwt-private")
+    if not os.environ.get("JWT_PUBLIC_KEY"):
+        os.environ["JWT_PUBLIC_KEY"] = _read_secret_file("/vault/secrets/django-jwt-public")
+
     ALLOWED_HOSTS = ["*"]
     FILE_UPLOAD_PERMISSIONS = 0o644
     DEBUG = False
     CSRF_COOKIE_SECURE = True
-    CSRF_TRUSTED_ORIGINS = ["https://lk.srx.wb.ru:30443", "https://lk.srx.wb.ru"]
+    CSRF_TRUSTED_ORIGINS = ["https://sarex.local.lonsdaleites.ru", "http://sarex.local.lonsdaleites.ru"]
     SESSION_COOKIE_SECURE = True
     SECURE_SSL_REDIRECT = False
 
@@ -48,7 +109,7 @@ data:
         'Bearer',
     )
 
-    HOST = "https://wb.sarex.io"
+    HOST = "https://sarex.local.lonsdaleites.ru"
 
     POSTGRES_DATABASE = os.environ.get('DJANGO_POSTGRES_DATABASE')
     POSTGRES_USER = os.environ.get('DJANGO_POSTGRES_USER')
@@ -67,6 +128,11 @@ data:
         }
     }
 
+    MEASUREMENTSETTINGS = MeasurementSettings()
+    WORKFLOWSSETTINGS = WorkFlowsSettings()
+    S3SETTINGS = S3Settings()
+    GATEWAYSETTINGS = GateWaySetttings()
+
     LOGGING = {
         'version': 1,
         'disable_existing_loggers': False,
@@ -111,8 +177,8 @@ data:
         'BLACKLIST_AFTER_ROTATION': True,
         'UPDATE_LAST_LOGIN': False,
         'ALGORITHM': 'RS512',
-        'SIGNING_KEY': os.environ.get("JWT_PRIVATE_KEY").replace("\\n", "\n"),
+        'SIGNING_KEY': os.environ.get("JWT_PRIVATE_KEY", "").replace("\\n", "\n"),
-        'VERIFYING_KEY': os.environ.get("JWT_PUBLIC_KEY").replace("\\n", "\n"),
+        'VERIFYING_KEY': os.environ.get("JWT_PUBLIC_KEY", "").replace("\\n", "\n"),
         'AUDIENCE': None,
         'ISSUER': os.environ.get('SIMPLE_JWT_ISSUER', 'default_issuer'),
         'AUTH_HEADER_TYPES': ('Bearer',),
@@ -154,6 +220,40 @@ data:
         },
     }
 
+    # Сессионная аутентификация без проверки CSRF.
+    #
+    # SPA платформы аутентифицируется сессионной кукой и не прикладывает
+    # заголовок X-CSRFToken, а SessionAuthentication из DRF требует его на
+    # любом небезопасном методе. Наружу это выглядело так:
+    #   DELETE /api/core/videos/<id>/  →  403
+    #   {"detail": "CSRF Failed: CSRF token missing."}
+    #
+    # Проверено на контуре: тот же запрос с X-CSRFToken проходит, и он же с
+    # заголовком Authorization: Bearer проходит тоже — до SessionAuthentication
+    # дело в этом случае просто не доходит, потому что simple_jwt в списке ниже
+    # стоит раньше. То есть бэкенд исправен, чинить нужно ровно сочетание
+    # "кука без заголовка".
+    #
+    # ЧЕМ ПЛАТИМ: с запросов, авторизованных кукой, снимается защита от CSRF.
+    # Основной вектор закрыт самими куками — sessionid и csrftoken выставляются
+    # с SameSite=Lax, и браузер не пошлёт их при кросс-сайтовом DELETE. Щель
+    # остаётся одна: SameSite смотрит на site, а не на origin, поэтому соседи
+    # по домену (minio., rabbitmq., dashboard.) считаются "своими", а в MinIO
+    # лежит пользовательский контент.
+    #
+    # Импорт DRF прямо в модуле настроек безопасен НЕ всегда — обычно так и
+    # ловят AppRegistryNotReady. Здесь проверено запуском django.setup() внутри
+    # работающего пода: rest_framework.authentication тянет только
+    # django.contrib.auth и rest_framework.exceptions, и ни один из них к
+    # моделям на уровне модуля не обращается.
+    from rest_framework.authentication import SessionAuthentication
+
+
+    class CsrfExemptSessionAuthentication(SessionAuthentication):
+        def enforce_csrf(self, request):
+            return
+
+
     REST_FRAMEWORK = {      'DEFAULT_PAGINATION_CLASS': (
         'rest_framework.pagination.LimitOffsetPagination'      ),
         'DEFAULT_SCHEMA_CLASS': 'rest_framework.schemas.coreapi.AutoSchema',
@@ -164,7 +264,7 @@ data:
         'rest_framework.authentication.RemoteUserAuthentication',
         'rest_framework_simplejwt.authentication.JWTAuthentication',
         'rest_framework.authentication.BasicAuthentication',
-        'rest_framework.authentication.SessionAuthentication',
+        'config.settings.production.CsrfExemptSessionAuthentication',
         'sarex.authentication.backends.JWTAuthentication'      ],
         'DEFAULT_PERMISSION_CLASSES': [
         'rest_framework.permissions.IsAuthenticated',      ]  }
@@ -228,17 +328,17 @@ data:
             "name": "Замечания",
             "uri": "/remarks"
         },
-        {
+        # {
-          "name": "Управление проектами",
+        #   "name": "Управление проектами",
-          "uri": "/management/projects",
+        #   "uri": "/management/projects",
-        },
+        # },
         {
             "name": "Замечания V2",
             "uri": "/issues"
         },
         {
             "name": "Документация",
-            "uri": "/documentations"
+            "uri": "/documentations",
         },
         {
             "name": "Согласование документов",
@@ -248,35 +348,35 @@ data:
             "name": "Рабочие процессы",
             "uri": "/processes"
         },
-         {
+        {
             "name": "Запросы",
             "uri": "/rfi"
         },
-
         {
-    		      "name": "Аналитика",
+            "name": "Управление проектами",
-    		      "uri": "/analytics"
+            "uri": "/management/projects"
-    		  },
+        },
+
         #  {
         #     "name": "Обзор",
         #     "uri": "/projects"
         # },
         {
-          "name": "Передача документации",
+        "name": "Передача документации", 
-          "uri": "/transmittal"
+        "uri": "/transmittal"
-          },
+        },
     ]
     AUTH_SETTINGS = {
-      "refresh_token": False,
+    "refresh_token": False,
-      "refresh_token_uri": "/api/token/me",
+    "refresh_token_uri": "/api/token/me",
-      "refresh_oauth_token": True,
+    "refresh_oauth_token": True,
-      "refresh_oauth_token_uri": "/oauth/token",
+    "refresh_oauth_token_uri": "/oauth/token",
-      "refresh_time": 240,
+    "refresh_time": 240,
     }
 
 
-    DEBUG=False
+    DEBUG=True
-    #WEB_APP_AUTH_MODE='jwt-session-based'
+    WEB_APP_AUTH_MODE='jwt-session-based'
 
 
     SAREX_MODULES_SETTINGS = {

apps/django/aero/kustomization.yaml

@@ -0,0 +1,262 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: django
+resources:
+  - ../base
+
+patches:
+  # Свой nginx.conf вместо базового: в base зашиты upstream'ы на namespace,
+  # которых в контуре нет, и nginx из-за этого не стартовал. Подробности —
+  # в шапке nginx-configmap.yaml.
+  #
+  # ИМЕННО ПАТЧ, а не resources. Объект с тем же kind+name уже пришёл из
+  # ../base, и добавление его вторым ресурсом валит сборку целиком:
+  #   may not add resource with an already registered id:
+  #   ConfigMap.v1.[noGrp]/nginx-configmap.django
+  # Перекрывать базовый ресурс можно только патчем.
+  - path: nginx-configmap.yaml
+    target:
+      kind: ConfigMap
+      name: nginx-configmap
+  # Настройки django: в base захардкожен домен ЧУЖОГО контура. По нему backend
+  # строил абсолютные ссылки на медиа, и браузер уходил на
+  #   https://sarex.contour.infra.sarex.tech/media/state/previews/....png
+  # получая 404. Причина копии та же, что у nginx-configmap: настройки лежат
+  # одним значением data.production.py, заменить можно только целиком.
+  - path: django-configmap.yaml
+    target:
+      kind: ConfigMap
+      name: django-configmap
+  # --- celery: те же правки, что и у backend --------------------------------
+  # Worker крутит тот же образ и те же настройки, поэтому и расхождения с base
+  # у него ровно те же: нет Kafka, нет Zitadel, MinIO живёт внутри кластера.
+  # Обоснования — в блоке backend ниже, здесь не дублирую.
+  #
+  # SERVER_ZITADEL_ENABLED правки не требует: в base у celery он уже "False"
+  # (в отличие от backend).
+  - target: {kind: HelmRelease, name: celery}
+    patch: |
+      - op: remove
+        path: /spec/values/services/celery/podAnnotations/_default/vault.hashicorp.com~1agent-inject-secret-django-kafka
+      - op: remove
+        path: /spec/values/services/celery/podAnnotations/_default/vault.hashicorp.com~1agent-inject-template-django-kafka
+      - op: remove
+        path: /spec/values/services/celery/podAnnotations/_default/vault.hashicorp.com~1agent-inject-secret-django-common
+      - op: remove
+        path: /spec/values/services/celery/podAnnotations/_default/vault.hashicorp.com~1agent-inject-template-django-common
+      - op: replace
+        path: /spec/values/services/celery/podAnnotations/_default/vault.hashicorp.com~1agent-inject-template-django-s3
+        value: |-
+          {{- with secret "secrets/data/minio/apps/django" }}
+          AWS_S3_ENDPOINT_URL=http://minio.minio.svc.cluster.local:9000
+          S3_HOST=http://minio.minio.svc.cluster.local:9000
+          {{- $buckets := index .Data.data "buckets" }}
+          S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }}
+          S3_LOGIN={{ index .Data.data "access_key" }}
+          S3_PASSWORD={{ index .Data.data "secret_key" }}
+          {{- end }}
+
+      # Стартовый скрипт без подключения django-kafka: этого секрета в контуре
+      # нет. migrate и создание администратора сюда НЕ добавляются — схемой
+      # владеет backend, а два процесса, катящих миграции наперегонки при
+      # одновременном старте, — это гонка на ровном месте.
+      - op: replace
+        path: /spec/values/services/celery/deployment/args/_default/0
+        value: |
+          set -a
+          [ -f /vault/secrets/django-postgresql ] && . /vault/secrets/django-postgresql
+          [ -f /vault/secrets/django-rabbitmq ] && . /vault/secrets/django-rabbitmq
+          [ -f /vault/secrets/django-s3 ] && . /vault/secrets/django-s3
+          [ -f /vault/secrets/django-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/django-jwt-private)"
+          [ -f /vault/secrets/django-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/django-jwt-public)"
+          set +a
+          exec celery -A config worker -B -l info -E -Q default -n default_worker.%h --concurrency=2
+
+      # Адреса на wb.sarex.io — чужой контур, из aero недостижим. В base их
+      # четыре, и все четыре у celery: у backend те же переменные уже указывают
+      # внутрь кластера. WORKFLOWS_USE=1, так что оставить как есть — значит
+      # получить зависания на недоступном домене вместо явной ошибки.
+      - op: test
+        path: /spec/values/services/celery/envs/15/name
+        value: SERVER_API_HOST
+      - op: replace
+        path: /spec/values/services/celery/envs/15/value/_default
+        value: https://sarex.local.lonsdaleites.ru
+      - op: test
+        path: /spec/values/services/celery/envs/16/name
+        value: SERVER_HOST
+      - op: replace
+        path: /spec/values/services/celery/envs/16/value/_default
+        value: https://sarex.local.lonsdaleites.ru
+      - op: test
+        path: /spec/values/services/celery/envs/17/name
+        value: WORKFLOWS_HOST
+      - op: replace
+        path: /spec/values/services/celery/envs/17/value/_default
+        value: http://backend-svc.processing.svc.cluster.local:80
+      - op: test
+        path: /spec/values/services/celery/envs/18/name
+        value: WORKFLOWS_BASE_HOST
+      - op: replace
+        path: /spec/values/services/celery/envs/18/value/_default
+        value: http://backend-svc.django.svc.cluster.local:80
+
+      # Тег образа выравнен с backend. В base у celery production_a96dead0, а у
+      # backend production_f813140d — worker и web крутили бы разный код, и
+      # рассинхрон вылезал бы не при старте, а на конкретной задаче: worker
+      # десериализует аргументы по своей версии модели.
+      - op: replace
+        path: /spec/values/services/celery/image/name/_default
+        value: cr.yandex/crp3ccidau046kdj8g9q/backend:production_f813140d
+
+  # --- s3-proxy: S3 внутри кластера ------------------------------------------
+  # В base адрес MinIO зашит ВНУТРИ vault-шаблона:
+  #   AWS_API_ENDPOINT=https://minio.contour.infra.sarex.tech
+  # Это чужой контур. Через values не перекрыть — значение внутри шаблона
+  # аннотации, поэтому заменяем аннотацию целиком, как у backend и celery.
+  #
+  # Проявлялось не отказом в соединении, а тем, что s3-proxy ДОСТУЧАЛСЯ до
+  # чужого MinIO и получил от него настоящий ответ S3:
+  #   SignatureDoesNotMatch: The request signature we calculated does not
+  #   match the signature you provided
+  # наружу это выглядело как 500 на каждую плитку /media/orthophotos/...
+  # Наши ключи в чужом хранилище, разумеется, не подходят — и хорошо, что так:
+  # иначе контур молча читал бы и писал в чужой S3.
+  - target: {kind: HelmRelease, name: s3-proxy}
+    patch: |
+      - op: replace
+        path: /spec/values/services/s3-proxy/podAnnotations/_default/vault.hashicorp.com~1agent-inject-template-s3
+        value: |
+          {{- with secret "secrets/data/minio/apps/django" }}
+          AWS_API_ENDPOINT=http://minio.minio.svc.cluster.local:9000
+          {{- $buckets := index .Data.data "buckets" }}
+          AWS_S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }}
+          AWS_ACCESS_KEY_ID={{ index .Data.data "access_key" }}
+          AWS_SECRET_ACCESS_KEY={{ index .Data.data "secret_key" }}
+          {{- end }}
+
+  # --- backend: убираем зависимости, которых в контуре нет ------------------
+  - target: {kind: HelmRelease, name: backend}
+    patch: |
+      # Kafka и Zitadel в контуре не развёрнуты. Само приложение без них живёт:
+      #   * SERVER_KAFKA_ENABLED в base уже "False", а в sarex-backend продюсер
+      #     создаётся только под флагом (config/settings/deps/kafka.py);
+      #   * zitadel_enabled читается ровно в одном месте — update_ams_user()
+      #     в sarex/core/utils.py, которая при выключенном флаге сразу выходит.
+      #     К аутентификации Zitadel отношения не имеет.
+      #
+      # Но аннотации инжекции убрать ОБЯЗАТЕЛЬНО: vault-agent-init не отрендерит
+      # шаблон для несуществующего секрета, упадёт, и под навсегда останется в
+      # Init:Error — приложение до своих флагов даже не дойдёт.
+      #
+      # В JSON Pointer слэш внутри ключа экранируется как ~1, поэтому
+      # vault.hashicorp.com/agent-... записан как vault.hashicorp.com~1agent-...
+      - op: remove
+        path: /spec/values/services/backend/podAnnotations/_default/vault.hashicorp.com~1agent-inject-secret-django-kafka
+      - op: remove
+        path: /spec/values/services/backend/podAnnotations/_default/vault.hashicorp.com~1agent-inject-template-django-kafka
+      - op: remove
+        path: /spec/values/services/backend/podAnnotations/_default/vault.hashicorp.com~1agent-inject-secret-django-common
+      - op: remove
+        path: /spec/values/services/backend/podAnnotations/_default/vault.hashicorp.com~1agent-inject-template-django-common
+
+      # S3 внутри кластера, а не через внешний домен. В base шаблон прибит к
+      # https://minio.contour.infra.sarex.tech — чужому домену, который отсюда
+      # не резолвится. Через values это не перекрыть: адрес зашит ВНУТРИ
+      # vault-шаблона аннотации, поэтому заменяем аннотацию целиком.
+      # Ходим напрямую в сервис MinIO, как это делал compose-стек.
+      - op: replace
+        path: /spec/values/services/backend/podAnnotations/_default/vault.hashicorp.com~1agent-inject-template-django-s3
+        value: |-
+          {{- with secret "secrets/data/minio/apps/django" }}
+          AWS_S3_ENDPOINT_URL=http://minio.minio.svc.cluster.local:9000
+          S3_HOST=http://minio.minio.svc.cluster.local:9000
+          {{- $buckets := index .Data.data "buckets" }}
+          S3_BUCKET={{ if gt (len $buckets) 0 }}{{ index (index $buckets 0) "name" }}{{ else }}django{{ end }}
+          S3_LOGIN={{ index .Data.data "access_key" }}
+          S3_PASSWORD={{ index .Data.data "secret_key" }}
+          {{- end }}
+
+      # Выключаем Zitadel. Операция test перед replace — страховка от смещения
+      # индекса: если в base порядок envs изменится, патч упадёт явно, вместо
+      # того чтобы молча перезаписать соседнюю переменную.
+      - op: test
+        path: /spec/values/services/backend/envs/2/name
+        value: SERVER_ZITADEL_ENABLED
+      - op: replace
+        path: /spec/values/services/backend/envs/2/value/_default
+        value: "False"
+
+      # Адреса на чужой контур. У celery те же две переменные поправлены выше,
+      # у backend они оставались с sarex.contour.infra.sarex.tech.
+      - op: test
+        path: /spec/values/services/backend/envs/17/name
+        value: SERVER_API_HOST
+      - op: replace
+        path: /spec/values/services/backend/envs/17/value/_default
+        value: https://sarex.local.lonsdaleites.ru
+      - op: test
+        path: /spec/values/services/backend/envs/18/name
+        value: SERVER_HOST
+      - op: replace
+        path: /spec/values/services/backend/envs/18/value/_default
+        value: https://sarex.local.lonsdaleites.ru
+
+      # --- Администратор платформы --------------------------------------------
+      # Учётка приезжает из Vault под именами, которые ждёт штатная
+      # createsuperuser --noinput. Секрет кладёт ansible
+      # (vault_app_secrets, secrets/apps/django/superuser).
+      - op: add
+        path: /spec/values/services/backend/podAnnotations/_default/vault.hashicorp.com~1agent-inject-secret-django-superuser
+        value: secrets/data/apps/django/superuser
+      - op: add
+        path: /spec/values/services/backend/podAnnotations/_default/vault.hashicorp.com~1agent-inject-template-django-superuser
+        value: |-
+          {{- with secret "secrets/data/apps/django/superuser" -}}
+          DJANGO_SUPERUSER_USERNAME={{ index .Data.data "username" }}
+          DJANGO_SUPERUSER_EMAIL={{ index .Data.data "email" }}
+          DJANGO_SUPERUSER_PASSWORD={{ index .Data.data "password" }}
+          {{- end -}}
+
+      # Стартовый скрипт целиком, а не точечная правка: JSON6902 умеет заменять
+      # только элемент списка, а вся логика запуска — один shell-блок args[0].
+      # Отличия от base:
+      #   * не подключается django-kafka — этого секрета в контуре нет;
+      #   * добавлены migrate и создание администратора.
+      #
+      # Почему migrate здесь, хотя его же делает /opt/sarex/entrypoint.sh:
+      # там он запущен без set -e, и его падение НИКАК не мешает uwsgi
+      # стартовать. Именно так контур несколько часов отдавал 200 на /admin/
+      # с пустой схемой БД, пока backend не мог аутентифицироваться. Здесь
+      # команда выполняется под set -e из command базы (/bin/sh -ec), поэтому
+      # неудача валит под в CrashLoopBackOff — то есть становится видимой.
+      # Повторный прогон внутри entrypoint.sh при уже накатанной схеме
+      # отрабатывает вхолостую за секунды.
+      - op: replace
+        path: /spec/values/services/backend/deployment/args/_default/0
+        value: |
+          set -a
+          [ -f /vault/secrets/django-postgresql ] && . /vault/secrets/django-postgresql
+          [ -f /vault/secrets/django-rabbitmq ] && . /vault/secrets/django-rabbitmq
+          [ -f /vault/secrets/django-s3 ] && . /vault/secrets/django-s3
+          [ -f /vault/secrets/django-superuser ] && . /vault/secrets/django-superuser
+          [ -f /vault/secrets/django-jwt-private ] && export JWT_PRIVATE_KEY="$(cat /vault/secrets/django-jwt-private)"
+          [ -f /vault/secrets/django-jwt-public ] && export JWT_PUBLIC_KEY="$(cat /vault/secrets/django-jwt-public)"
+          set +a
+
+          python manage.py migrate --noinput
+
+          # Идемпотентно по построению: команда отрабатывает при КАЖДОМ старте
+          # пода, а на уже существующем логине штатно возвращает
+          # "That username is already taken" с ненулевым кодом. Ошибка ожидаема
+          # и гасится веткой else, иначе set -e ронял бы под на втором запуске.
+          if [ -n "${DJANGO_SUPERUSER_USERNAME:-}" ]; then
+            if python manage.py createsuperuser --noinput; then
+              echo "entrypoint: администратор создан"
+            else
+              echo "entrypoint: администратор уже существует, пропускаем"
+            fi
+          fi
+
+          exec /opt/sarex/entrypoint.sh

apps/django/aero/nginx-configmap.yaml

@@ -0,0 +1,194 @@
+# Копия nginx-configmap из base с правками под контур aero.
+#
+# Патчем это сделать нельзя: конфиг лежит одной строкой в data.nginx.conf,
+# и kustomize умеет только заменить значение целиком.
+#
+# ЧТО ИЗМЕНЕНО ОТНОСИТЕЛЬНО base — три вещи:
+#
+# 1. Убран location /api/pm/. Сервис pm в контуре не нужен и не планируется.
+#
+# 2. Для workspaces и processing адрес вынесен в переменную и добавлен
+#    resolver. Причина: nginx резолвит все upstream'ы ПРИ СТАРТЕ и падает
+#    целиком, если хоть один не найден:
+#      nginx: [emerg] host not found in upstream "backend-svc.pm..."
+#    Из-за этого весь frontend уходил в CrashLoopBackOff, хотя не работал
+#    лишь один маршрут. С переменной nginx откладывает резолвинг до запроса:
+#    сейчас эти пути отдают 502, а когда сервисы приедут — заработают сами,
+#    без правки конфига и перезапуска.
+#
+#    ПОРЯДОК ДИРЕКТИВ ВНУТРИ ТАКОГО location ЗНАЧИМ: set обязан идти ДО
+#    rewrite ... break. Обе директивы принадлежат ngx_http_rewrite_module, а
+#    флаг break прекращает обработку его директив в этом location — set после
+#    него просто не выполняется, переменная остаётся пустой, и запрос падает с
+#      [error] no host in upstream ":80"
+#    отдавая наружу 500. Именно так и было: / работал, а /workspaces-v2/... и
+#    /workflows/... возвращали 500, пока set стоял ниже rewrite.
+#
+# 3. backend-svc оставлен прямой ссылкой: он в этом же namespace и существует
+#    всегда, откладывать его резолвинг незачем — наоборот, ошибка в имени
+#    обнаружится сразу при старте.
+#
+# Адрес resolver'а — CoreDNS кластера. В k3s он называется kube-dns
+# (имя сохранено для совместимости), namespace kube-system.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nginx-configmap
+  namespace: django
+data:
+  nginx.conf: |
+    worker_processes auto;
+
+    pid /var/run/nginx.pid;
+
+    events {
+        use epoll;
+        worker_connections 1024;
+    }
+
+    http {
+
+        # Basic Settings
+        large_client_header_buffers 8 128k;
+        sendfile on;
+        tcp_nopush on;
+        tcp_nodelay on;
+        keepalive_timeout 300;
+        types_hash_max_size 2048;
+        client_max_body_size 5000M;
+        client_header_buffer_size 5M;
+        include /etc/nginx/mime.types;
+        default_type application/octet-stream;
+
+        # Logging Settings
+        access_log /var/log/nginx/access.log;
+        error_log /var/log/nginx/error.log;
+
+        # GZIP Settings
+        gzip on;
+        gzip_vary on;
+        gzip_proxied any;
+        gzip_comp_level 6;
+        gzip_buffers 16 8k;
+        gzip_http_version 1.1;
+        gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
+
+        log_format main '$remote_addr - $remote_user [$time_local] "$request" '
+                        '$status $body_bytes_sent "$http_referer" '
+                        '"$http_user_agent" "$http_x_forwarded_for"';
+
+        # Резолвер нужен для upstream'ов, заданных переменной (см. ниже).
+        resolver kube-dns.kube-system.svc.cluster.local valid=30s ipv6=off;
+
+        server {
+            listen 80;
+            listen [::]:80;
+            root /opt/react_client/;
+
+            add_header 'Access-Control-Allow-Origin' '*' always;
+            add_header 'Access-Control-Allow-Methods' '*' always;
+            add_header 'Access-Control-Allow-Headers' '*' always;
+
+            location = /static/index.bundle.js {
+                add_header Cache-Control 'no-store no-cache, must-revalidate, proxy-revalidate, max-age=0';
+                if_modified_since off;
+                expires off;
+            }
+
+            # Выбор способа аутентификации. Фронтенд на старте делает
+            # fetch("/static/config.json") и, если там есть auth_type,
+            # БЕЗУСЛОВНО перекрывает им режим, зашитый в сборку
+            # (src/Model/api/http-service.ts). Значения ровно два:
+            # "zitadel" и "original"; original — классический вход по
+            # логину и паролю с JWT, ради которого backend и получает из
+            # Vault ключи RS512.
+            #
+            # В образе sarex-frontend-dev:contour_* этот файл лежит со
+            # значением zitadel и хостом zitadel.contour.infra.sarex.tech —
+            # чужой контур, из aero недоступен. Из-за него платформа
+            # редиректила на /oauth/v2/authorize и получала
+            #   invalid_request: The requested redirect_uri is missing
+            #   in the client configuration
+            # то есть войти было нельзя в принципе.
+            #
+            # Отдаём файл прямо из nginx, не подкладывая том: сам
+            # static/config.json в sarex-frontend лежит в .gitignore и
+            # заполняется на каждом стенде своим — это штатная точка
+            # расширения, а не обход. В апстримном nginx.conf под него уже
+            # заведён такой же location =, только читающий с диска.
+            #
+            # Подменить через localStorage нельзя: оверрайд оттуда
+            # действует лишь для endpoint'ов stage, preprod и local,
+            # contour в этом списке нет.
+            #
+            # ВАЖНО ПРИ ПРОВЕРКЕ: правка НЕ видна с первой перезагрузки.
+            # Класс Config (src/shared/config/config.ts) держит копию в
+            # localStorage под ключом "config" и на старте берёт СИНХРОННО
+            # кеш, а файл сверяет уже асинхронно:
+            #   if (this.cacheData) { this.data = this.cacheData;
+            #                         this.invalidateCache(); }
+            # а http-service.ts читает auth_type в момент импорта модуля.
+            # Поэтому первая загрузка после правки лишь обновляет кеш, а
+            # применяется он со второй. Ускорить —
+            #   localStorage.removeItem('config')
+            # Консоль удобно открыть на /static/config.json: тот же origin,
+            # но JS не выполняется и редиректа на Zitadel не будет.
+            location = /static/config.json {
+                default_type application/json;
+                add_header Cache-Control 'no-store no-cache, must-revalidate, proxy-revalidate, max-age=0';
+                if_modified_since off;
+                expires off;
+                return 200 '{"auth_type":"original"}';
+            }
+
+            # location /api/pm/ из base удалён: сервис pm контуру не нужен.
+
+            location ~^/(api|admin)/ {
+                proxy_http_version 1.1;
+                proxy_set_header Connection "";
+                proxy_set_header Host $host;
+                proxy_pass http://backend-svc.django.svc.cluster.local:80;
+            }
+
+            # workspaces появится позже — резолвим лениво, через переменную.
+            location ~^/workspaces-v2/(.+).js {
+                proxy_http_version 1.1;
+                proxy_set_header Connection "";
+                set $up_workspaces frontend-svc.workspaces.svc.cluster.local;
+                rewrite /workspaces-v2/(.+) /$1 break;
+                proxy_pass http://$up_workspaces:80;
+            }
+
+            location ~^/workspaces-v2/(.+)\.wasm$ {
+                proxy_http_version 1.1;
+                proxy_set_header Connection "";
+                set $up_workspaces_wasm frontend-svc.workspaces.svc.cluster.local;
+                rewrite ^/workspaces-v2/(.+) /$1 break;
+                proxy_pass http://$up_workspaces_wasm:80;
+            }
+
+            location @index {
+                add_header Cache-Control 'no-cache, must-revalidate, proxy-revalidate, max-age=0';
+                if_modified_since off;
+                expires off;
+                try_files /static/index.html =404;
+            }
+
+            # processing появится позже — тоже лениво.
+            location ~^/workflows/(.+).js {
+                proxy_http_version 1.1;
+                proxy_set_header Connection "";
+                set $up_processing frontend-svc.processing.svc.cluster.local;
+                rewrite /workflows/(.+) /$1 break;
+                proxy_pass http://$up_processing:80;
+            }
+
+            location /service-worker.js {
+                try_files /static/$uri @index;
+            }
+
+            location / {
+                try_files $uri @index;
+            }
+        }
+    }

apps/django/wb/auth-flow-frontend.yaml

@@ -1,97 +0,0 @@
----
-# auth-flow-frontend — компонент приложения auth-flow (apps/auth-flow),
-# в wb развёрнут в ns django, а не в своём собственном неймспейсе.
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: auth-flow-frontend
-  namespace: django
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      auth-flow-frontend:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/auth-flow-frontend:contour_fe9ea2a3
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: auth-flow-frontend
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 80
-
-          resources:
-            requests:
-              cpu:
-                _default: 100m
-              memory:
-                _default: 128Mi
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: true
-
-          name:
-            _default: auth-flow-frontend-service
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 80
-
-          targetPort:
-            _default: 80
-
-          portName:
-            _default: http
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/django/wb/backend.yaml

@@ -1,444 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: backend
-  namespace: django
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      backend:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/backend:production_7d0ec48b
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: backend
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 8000
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: true
-
-          name:
-            _default: backend-svc
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 8000
-
-          targetPort:
-            _default: 8000
-
-          portName:
-            _default: http
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        volumes:
-          _default:
-            - name: tmp-volume
-              mountPath:
-                _default: /tmp
-              emptyDir: {}
-
-            - name: uwsgi-configmap
-              mountPath:
-                _default: /opt/sarex/uwsgi.ini
-              subPath:
-                _default: uwsgi.ini
-              readOnly:
-                _default: true
-              configMap:
-                name:
-                  _default: uwsgi-configmap
-                items:
-                  - key: uwsgi.ini
-                    path:
-                      _default: uwsgi.ini
-
-            - name: django-configmap
-              mountPath:
-                _default: /opt/sarex/config/settings/production.py
-              subPath:
-                _default: production.py
-              readOnly:
-                _default: true
-              configMap:
-                name:
-                  _default: django-configmap
-                items:
-                  - key: production.py
-                    path:
-                      _default: production.py
-
-            - name: kafka-cert-volume
-              mountPath:
-                _default: /usr/local/share/ca-certificates
-              readOnly:
-                _default: true
-              configMap:
-                name:
-                  _default: kafka-cert
-
-        envs:
-          - name: GK_ENCRYPTION_KEY
-            value:
-              _default: "zfDjuszywHSbAhY8KJQbESbpUYN74XTs"
-
-          - name: ALLOWED_HOSTS
-            value:
-              _default: "*"
-
-          - name: SERVER_USE_CHANGELOG
-            value:
-              _default: "0"
-
-          - name: SERVER_ZITADEL_ENABLED
-            value:
-              _default: "True"
-
-          - name: DJANGO_SETTINGS_MODULE
-            value:
-              _default: "config.settings.production"
-
-          - name: CELERY_REDIS_HOST
-            value:
-              _default: "redis-service"
-
-          - name: CELERY_REDIS_PORT
-            value:
-              _default: "6379"
-
-          - name: DJANGO_REDIS_HOST
-            value:
-              _default: "redis-service"
-
-          - name: DJANGO_REDIS_PORT
-            value:
-              _default: "6379"
-
-          - name: BIMV2_INTERNAL_HOST
-            value:
-              _default: "http://bim-backend-v2-service.bim-api"
-
-          - name: BIMV2_TIMEOUT
-            value:
-              _default: "60"
-
-          - name: JWT_KID
-            value:
-              _default: "1"
-
-          - name: PDM_SYNC
-            value:
-              _default: "1"
-
-          - name: KC_SYNC_ENABLE
-            value:
-              _default: "0"
-
-          - name: MEASUREMENTS_HOST
-            value:
-              _default: "http://measurements-service.measurements.svc.cluster.local:8000/api"
-
-          - name: MEASUREMENTS_USE_MEASUREMENTS
-            value:
-              _default: "1"
-
-          - name: SERVER_EXTERNAL_FIND_BY_USERNAME_ENABLED
-            value:
-              _default: "True"
-
-          - name: SERVER_EXTERNAL_FIND_BY_EMAIL_ENABLED
-            value:
-              _default: "True"
-
-          - name: SERVER_API_HOST
-            value:
-              _default: "https://srx.wb.ru"
-
-          - name: SERVER_HOST
-            value:
-              _default: "https://srx.wb.ru"
-
-          - name: WORKFLOWS_HOST
-            value:
-              _default: "https://srx.wb.ru"
-
-          - name: WORKFLOWS_BASE_HOST
-            value:
-              _default: "https://srx.wb.ru"
-
-          - name: WORKFLOWS_USE
-            value:
-              _default: "1"
-
-          - name: SERVER_S3_STREAM_IMPORT
-            value:
-              _default: "1"
-
-          - name: SERVER_SAVE_DIFF_DEM
-            value:
-              _default: "1"
-
-          - name: SERVER_USE_CLICKHOUSE
-            value:
-              _default: "0"
-
-          - name: SERVER_USE_CREATE_COMPARED_GEOTIFF_TASK
-            value:
-              _default: "0"
-
-          - name: SERVER_USE_DJANGO_STORAGE
-            value:
-              _default: "1"
-
-          - name: SERVER_USE_METASHAPE
-            value:
-              _default: "0"
-
-          - name: SERVER_CHANGELOG_MODE_SYSTEM_LOG
-            value:
-              _default: "1"
-
-          - name: SERVER_CHANGELOG_MODE
-            value:
-              _default: "0"
-
-          - name: SERVER_DJANGO_URLS
-            value:
-              _default: "1"
-
-          - name: CHECK_IMPORT_HASH
-            value:
-              _default: "1"
-
-          - name: EAV_ENABLE
-            value:
-              _default: "1"
-
-          - name: SERVER_CHECK_IMPORT_HASH
-            value:
-              _default: "1"
-
-          - name: SERVER_CHUNKED_PATH
-            value:
-              _default: "/tmp/chunked_uploads/%Y/%m/%d"
-
-          - name: SERVER_HIDE_USER_SCROLL_PERMISSIONS
-            value:
-              _default: "0"
-
-          - name: SERVER_USE_WRORKFLOW_STATUS
-            value:
-              _default: "1"
-
-          - name: ZITADEL_HOST
-            value:
-              _default: "https://zitadel-srx.wb.ru"
-
-          - name: SERVER_KAFKA_ENABLED
-            value:
-              _default: "True"
-
-          - name: KAFKA_TOPICS
-            value:
-              _default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}'
-
-          - name: KAFKA_BOOTSTRAP_SERVERS
-            value:
-              _default: '["wb-prod-kafka-bootstrap.kafka.svc.cluster.local:9093"]'
-
-          - name: KAFKA_SECURITY_PROTOCOL
-            value:
-              _default: "SSL"
-
-          - name: KAFKA_SASL_MECHANISM
-            value:
-              _default: "SCRAM-SHA-512"
-
-          - name: KAFKA_SSL_CAFILE
-            value:
-              _default: "/usr/local/share/ca-certificates/kafka.crt"
-
-          - name: S3_HOST
-            value:
-              _default: "http://10.49.10.90:9000"
-
-          - name: KC_USE_REDIRECT_LOGOUT
-            value:
-              _default: "False"
-
-        secretEnvs:
-          - name: ZITADEL_ACCESS_TOKEN
-            secretName:
-              _default: "zitadel-secret"
-            secretKey: "access_token"
-
-          - name: KAFKA_SASL_PLAIN_USERNAME
-            secretName:
-              _default: "kafka-secret"
-            secretKey: "username"
-
-          - name: KAFKA_SASL_PLAIN_PASSWORD
-            secretName:
-              _default: "kafka-secret"
-            secretKey: "password"
-
-          - name: KC_CLIENT_ID
-            secretName:
-              _default: "gatekeeper-secret"
-            secretKey: "client_id"
-
-          - name: KC_CLIENT_SECRET
-            secretName:
-              _default: "gatekeeper-secret"
-            secretKey: "client_secret"
-
-          - name: AWS_S3_ENDPOINT_URL
-            secretName:
-              _default: "s3-secret"
-            secretKey: "endpoint"
-
-          - name: CELERY_RABBITMQ_HOST
-            secretName:
-              _default: "rabbitmq-secret"
-            secretKey: "host"
-
-          - name: CELERY_RABBITMQ_USER
-            secretName:
-              _default: "rabbitmq-secret"
-            secretKey: "username"
-
-          - name: CELERY_RABBITMQ_PASSWORD
-            secretName:
-              _default: "rabbitmq-secret"
-            secretKey: "password"
-
-          - name: CELERY_RABBITMQ_VHOST
-            secretName:
-              _default: "rabbitmq-secret"
-            secretKey: "vhost"
-
-          - name: DJANGO_POSTGRES_HOST
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "host"
-
-          - name: DJANGO_POSTGRES_PORTS
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "port"
-
-          - name: DJANGO_POSTGRES_USER
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "username"
-
-          - name: DJANGO_POSTGRES_PASSWORD
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "password"
-
-          - name: DJANGO_POSTGRES_DATABASE
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "database"
-
-          - name: DJANGO_RABBIT_HOSTNAME
-            secretName:
-              _default: "rabbitmq-secret"
-            secretKey: "host"
-
-          - name: DJANGO_RABBIT_USER
-            secretName:
-              _default: "rabbitmq-secret"
-            secretKey: "username"
-
-          - name: DJANGO_RABBIT_PASS
-            secretName:
-              _default: "rabbitmq-secret"
-            secretKey: "password"
-
-          - name: DJANGO_RABBIT_VHOST
-            secretName:
-              _default: "rabbitmq-secret"
-            secretKey: "vhost"
-
-          - name: JWT_PRIVATE_KEY
-            secretName:
-              _default: "backend-secret"
-            secretKey: "ssh_private.key"
-
-          - name: JWT_PUBLIC_KEY
-            secretName:
-              _default: "backend-secret"
-            secretKey: "ssh_public.key"
-
-          - name: S3_BUCKET
-            secretName:
-              _default: "sarex-media-storage-secret"
-            secretKey: "bucket"
-
-          - name: S3_LOGIN
-            secretName:
-              _default: "sarex-media-storage-secret"
-            secretKey: "login"
-
-          - name: S3_PASSWORD
-            secretName:
-              _default: "sarex-media-storage-secret"
-            secretKey: "password"
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/django/wb/celery.yaml

@@ -1,428 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: celery
-  namespace: django
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      celery:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/backend:production_7d0ec48b
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: celery
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 8000
-
-          command:
-            _default: ["celery", "-A", "config", "worker", "-B", "-l", "info", "-E", "-Q", "default", "-n", "default_worker.%h", "--concurrency=2"]
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: false
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        volumes:
-          _default:
-            - name: tmp-volume
-              mountPath:
-                _default: /tmp
-              emptyDir: {}
-
-            - name: uwsgi-configmap
-              mountPath:
-                _default: /opt/sarex/uwsgi.ini
-              subPath:
-                _default: uwsgi.ini
-              readOnly:
-                _default: true
-              configMap:
-                name:
-                  _default: uwsgi-configmap
-                items:
-                  - key: uwsgi.ini
-                    path:
-                      _default: uwsgi.ini
-
-            - name: django-configmap
-              mountPath:
-                _default: /opt/sarex/config/settings/production.py
-              subPath:
-                _default: production.py
-              readOnly:
-                _default: true
-              configMap:
-                name:
-                  _default: django-configmap
-                items:
-                  - key: production.py
-                    path:
-                      _default: production.py
-
-            - name: kafka-cert-volume
-              mountPath:
-                _default: /usr/local/share/ca-certificates
-              readOnly:
-                _default: true
-              configMap:
-                name:
-                  _default: kafka-cert
-
-        envs:
-          - name: GK_ENCRYPTION_KEY
-            value:
-              _default: "zfDjuszywHSbAhY8KJQbESbpUYN74XTs"
-
-          - name: ALLOWED_HOSTS
-            value:
-              _default: "*"
-
-          - name: SERVER_USE_CHANGELOG
-            value:
-              _default: "0"
-
-          - name: SERVER_ZITADEL_ENABLED
-            value:
-              _default: "False"
-
-          - name: DJANGO_SETTINGS_MODULE
-            value:
-              _default: "config.settings.production"
-
-          - name: CELERY_REDIS_HOST
-            value:
-              _default: "redis-service"
-
-          - name: CELERY_REDIS_PORT
-            value:
-              _default: "6379"
-
-          - name: DJANGO_REDIS_HOST
-            value:
-              _default: "redis-service"
-
-          - name: CACHE_HOST
-            value:
-              _default: "redis.pm.svc.cluster.local"
-
-          - name: DJANGO_REDIS_PORT
-            value:
-              _default: "6379"
-
-          - name: BIMV2_INTERNAL_HOST
-            value:
-              _default: "http://bim-backend-v2-service.bim-api"
-
-          - name: BIMV2_TIMEOUT
-            value:
-              _default: "60"
-
-          - name: JWT_KID
-            value:
-              _default: "1"
-
-          - name: PDM_SYNC
-            value:
-              _default: "1"
-
-          - name: KC_SYNC_ENABLE
-            value:
-              _default: "0"
-
-          - name: MEASUREMENTS_HOST
-            value:
-              _default: "http://measurements-service.measurements.svc.cluster.local:8000/api"
-
-          - name: MEASUREMENTS_USE_MEASUREMENTS
-            value:
-              _default: "1"
-
-          - name: SERVER_API_HOST
-            value:
-              _default: "https://srx.wb.ru"
-
-          - name: SERVER_HOST
-            value:
-              _default: "https://srx.wb.ru"
-
-          - name: WORKFLOWS_HOST
-            value:
-              _default: "https://srx.wb.ru"
-
-          - name: WORKFLOWS_BASE_HOST
-            value:
-              _default: "https://srx.wb.ru"
-
-          - name: WORKFLOWS_USE
-            value:
-              _default: "1"
-
-          - name: SERVER_S3_STREAM_IMPORT
-            value:
-              _default: "1"
-
-          - name: SERVER_SAVE_DIFF_DEM
-            value:
-              _default: "1"
-
-          - name: SERVER_USE_CLICKHOUSE
-            value:
-              _default: "0"
-
-          - name: SERVER_USE_CREATE_COMPARED_GEOTIFF_TASK
-            value:
-              _default: "0"
-
-          - name: SERVER_USE_DJANGO_STORAGE
-            value:
-              _default: "1"
-
-          - name: SERVER_USE_METASHAPE
-            value:
-              _default: "0"
-
-          - name: SERVER_CHANGELOG_MODE_SYSTEM_LOG
-            value:
-              _default: "1"
-
-          - name: ZITADEL_HOST
-            value:
-              _default: "https://zitadel-srx.wb.ru"
-
-          - name: SERVER_KAFKA_ENABLED
-            value:
-              _default: "True"
-
-          - name: KAFKA_TOPICS
-            value:
-              _default: '{"planning": "message-hub-stage", "ams-sync": "ams-sync"}'
-
-          - name: KAFKA_BOOTSTRAP_SERVERS
-            value:
-              _default: '["wb-prod-kafka-bootstrap.kafka.svc.cluster.local:9093"]'
-
-          - name: KAFKA_SECURITY_PROTOCOL
-            value:
-              _default: "SSL"
-
-          - name: KAFKA_SASL_MECHANISM
-            value:
-              _default: "SCRAM-SHA-512"
-
-          - name: KAFKA_SSL_CAFILE
-            value:
-              _default: "/usr/local/share/ca-certificates/kafka.crt"
-
-          - name: SERVER_CHANGELOG_MODE
-            value:
-              _default: "0"
-
-          - name: SERVER_DJANGO_URLS
-            value:
-              _default: "1"
-
-          - name: CHECK_IMPORT_HASH
-            value:
-              _default: "1"
-
-          - name: EAV_ENABLE
-            value:
-              _default: "1"
-
-          - name: SERVER_CHECK_IMPORT_HASH
-            value:
-              _default: "1"
-
-          - name: SERVER_CHUNKED_PATH
-            value:
-              _default: "/tmp/chunked_uploads/%Y/%m/%d"
-
-          - name: SERVER_HIDE_USER_SCROLL_PERMISSIONS
-            value:
-              _default: "0"
-
-          - name: SERVER_USE_WRORKFLOW_STATUS
-            value:
-              _default: "1"
-
-          - name: S3_HOST
-            value:
-              _default: "http://10.49.10.90:9000"
-
-          - name: KC_USE_REDIRECT_LOGOUT
-            value:
-              _default: "False"
-
-        secretEnvs:
-          - name: ZITADEL_ACCESS_TOKEN
-            secretName:
-              _default: "zitadel-secret"
-            secretKey: "access_token"
-
-          - name: KAFKA_SASL_PLAIN_USERNAME
-            secretName:
-              _default: "kafka-secret"
-            secretKey: "username"
-
-          - name: KAFKA_SASL_PLAIN_PASSWORD
-            secretName:
-              _default: "kafka-secret"
-            secretKey: "password"
-
-          - name: KC_CLIENT_ID
-            secretName:
-              _default: "gatekeeper-secret"
-            secretKey: "client_id"
-
-          - name: KC_CLIENT_SECRET
-            secretName:
-              _default: "gatekeeper-secret"
-            secretKey: "client_secret"
-
-          - name: AWS_S3_ENDPOINT_URL
-            secretName:
-              _default: "s3-secret"
-            secretKey: "endpoint"
-
-          - name: CELERY_RABBITMQ_HOST
-            secretName:
-              _default: "rabbitmq-secret"
-            secretKey: "host"
-
-          - name: CELERY_RABBITMQ_USER
-            secretName:
-              _default: "rabbitmq-secret"
-            secretKey: "username"
-
-          - name: CELERY_RABBITMQ_PASSWORD
-            secretName:
-              _default: "rabbitmq-secret"
-            secretKey: "password"
-
-          - name: CELERY_RABBITMQ_VHOST
-            secretName:
-              _default: "rabbitmq-secret"
-            secretKey: "vhost"
-
-          - name: DJANGO_POSTGRES_HOST
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "host"
-
-          - name: DJANGO_POSTGRES_PORTS
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "port"
-
-          - name: DJANGO_POSTGRES_USER
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "username"
-
-          - name: DJANGO_POSTGRES_PASSWORD
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "password"
-
-          - name: DJANGO_POSTGRES_DATABASE
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "database"
-
-          - name: DJANGO_RABBIT_HOSTNAME
-            secretName:
-              _default: "rabbitmq-secret"
-            secretKey: "host"
-
-          - name: DJANGO_RABBIT_USER
-            secretName:
-              _default: "rabbitmq-secret"
-            secretKey: "username"
-
-          - name: DJANGO_RABBIT_PASS
-            secretName:
-              _default: "rabbitmq-secret"
-            secretKey: "password"
-
-          - name: DJANGO_RABBIT_VHOST
-            secretName:
-              _default: "rabbitmq-secret"
-            secretKey: "vhost"
-
-          - name: JWT_PRIVATE_KEY
-            secretName:
-              _default: "backend-secret"
-            secretKey: "ssh_private.key"
-
-          - name: JWT_PUBLIC_KEY
-            secretName:
-              _default: "backend-secret"
-            secretKey: "ssh_public.key"
-
-          - name: S3_BUCKET
-            secretName:
-              _default: "sarex-media-storage-secret"
-            secretKey: "bucket"
-
-          - name: S3_LOGIN
-            secretName:
-              _default: "sarex-media-storage-secret"
-            secretKey: "login"
-
-          - name: S3_PASSWORD
-            secretName:
-              _default: "sarex-media-storage-secret"
-            secretKey: "password"
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/django/wb/export-project.yaml

@@ -1,105 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: export-project
-  namespace: django
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      export-project:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/export-project:prod_ef8aa756
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: export-project
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 8000
-
-          resources:
-            limits:
-              cpu:
-                _default: "2"
-              memory:
-                _default: 8Gi
-            requests:
-              cpu:
-                _default: "1"
-              memory:
-                _default: 512Mi
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: true
-
-          name:
-            _default: export-project-service
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 8000
-
-          targetPort:
-            _default: 8000
-
-          portName:
-            _default: http
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        envs:
-          - name: TIMEOUT
-            value:
-              _default: "180"
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/django/wb/frontend.yaml

@@ -1,118 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: frontend
-  namespace: django
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      frontend:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-frontend-dev:contour_5.22.3
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: frontend
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 80
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: true
-
-          name:
-            _default: frontend-service
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 80
-
-          targetPort:
-            _default: 80
-
-          portName:
-            _default: http
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        volumes:
-          _default:
-            - name: nginx-configmap
-              mountPath:
-                _default: /etc/nginx/nginx.conf
-              subPath:
-                _default: nginx.conf
-              configMap:
-                name:
-                  _default: nginx-configmap
-                items:
-                  - key: nginx.conf
-                    path:
-                      _default: nginx.conf
-
-            - name: zitadel-configmap
-              mountPath:
-                _default: /opt/react_client/static/config.json
-              subPath:
-                _default: config.json
-              readOnly:
-                _default: true
-              configMap:
-                name:
-                  _default: zitadel-configmap
-                items:
-                  - key: config.json
-                    path:
-                      _default: config.json
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/django/wb/gatekeeper.yaml

@@ -1,120 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: gatekeeper
-  namespace: django
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      gatekeeper:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/gatekeeper:2.12.1
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: gatekeeper
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 8080
-
-          args:
-            _default:
-              - "--discovery-url=https://keycloak.wildberries.ru/realms/infrastructure/.well-known/openid-configuration"
-              - "--listen=0.0.0.0:8080"
-              - "--enable-logging=true"
-              - "--upstream-url=http://frontend-service.django.svc.cluster.local:80/"
-              - "--enable-refresh-tokens=true"
-              - "--enable-session-cookies=true"
-              - "--verbose"
-              - "--resources=uri=/*"
-              - "--encryption-key=zfDjuszywHSbAhY8KJQbESbpUYN74XTs"
-              - "--secure-cookie=false"
-              - "--cors-origins=*"
-              - "--skip-openid-provider-tls-verify=true"
-              - "--enable-default-deny=false"
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: true
-
-          name:
-            _default: gatekeeper-service
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 80
-
-          targetPort:
-            _default: 8080
-
-          portName:
-            _default: http
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        envs:
-          - name: PROXY_REDIRECTION_URL
-            value:
-              _default: "https://lk.srx.wb.ru"
-
-        secretEnvs:
-          - name: PROXY_CLIENT_ID
-            secretName:
-              _default: "gatekeeper-secret"
-            secretKey: "client_id"
-
-          - name: PROXY_CLIENT_SECRET
-            secretName:
-              _default: "gatekeeper-secret"
-            secretKey: "client_secret"
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/django/wb/kafka-cert-configmap.yaml

@@ -1,38 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: kafka-cert
-  namespace: django
-data:
-  kafka.crt: |
-    -----BEGIN CERTIFICATE-----
-    MIIFLTCCAxWgAwIBAgIUYDZPxGRsr7IiqHEmfd07QTQlOKYwDQYJKoZIhvcNAQEN
-    BQAwLTETMBEGA1UECgwKaW8uc3RyaW16aTEWMBQGA1UEAwwNY2x1c3Rlci1jYSB2
-    MDAeFw0yNTEyMTYxNDM0NTVaFw0yNjEyMTYxNDM0NTVaMC0xEzARBgNVBAoMCmlv
-    LnN0cmltemkxFjAUBgNVBAMMDWNsdXN0ZXItY2EgdjAwggIiMA0GCSqGSIb3DQEB
-    AQUAA4ICDwAwggIKAoICAQCfzDZhEzw2pbU5Xpu8OzD+3iQG+DVjU8PQWWQEF27h
-    yjohDkUr3zCZtW7xMKWKUNxBgrKsfe4TDOQN8cij3cS9sy0So+UhMeF7Bq9PU1Yd
-    bmTRq8q1PiuNUkiCGJ5wrb3+NZvVxZLJUIFgiealsRw80MgMWWSzy0I35T2Edn/a
-    DU4jhlgQxyzQ621+oGP0n28gCjmm6pCq2tkj/Z8WTdu1gOWyRdK02a2uE2Ts2nLa
-    Di32GaZrIbIuD/WUd6Ek66uCeJvh2CT7s+SqgtMbtT7gibUuPQ3hk1VGQsjy22l3
-    hUNpLu86nrwbuf21mY55KnLOcaVq1ag1TpIIKfZAL/KWFCGZ6H6kwEIbCAL0Hei7
-    cJ2Wm2/qlzKUeU869M7YybZAfXl/t6XT4QgFgje+42N980vy5A4GhWi1Z7lPqqOe
-    jPGBstkRZybKz1sTk87+oJx82iQU/ozVmzjSEK1SoYRNbvug8PNpxmPoPnJ2flgG
-    t2q2+2ZQP3f1aAHVcZ3U5+hWlRmKPXzjrJv7gnhuvqJl7OwB50y+yWiVfZ9xrYl2
-    EpX+yHuFFK+9NnB5taUK8Fz+hQaLU8J4q7P0bRqkoI+LdcEErjuDT/eI2d5+Ql8K
-    /JkV823hX2WNB9bdaQ24BelVUbsxGpR7ms6KWrM11kHnbzUlEM+AxZES6F7Qbr55
-    TwIDAQABo0UwQzAdBgNVHQ4EFgQUM7hshx7e9TFEN82Pf446aBrJUA4wEgYDVR0T
-    AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQENBQADggIB
-    AFNHFGPDxY966fz0dxDFFSfeo47y7XQZMK9xAwH73cQoSeqx+IMxzgM8nfJQ9XMN
-    PeLwVRZ7pvRee2ZhUPglBSTHnW2rvfmLBOO9xyKZxRsCkoFxuHH9xfM7bFWb96R6
-    fGrOdEZDB3yj00T+tkubwqt+/dUhQUj8juwyPs55WMb/0BIbapaoQ6QOP13CaXDV
-    ZmAfsEEIBkNxfq7GTr/z0Rq0B4+9FxAf3Jrsmi/dYoFD/prHsvBDkYw1daoFyp5C
-    tbctvB9wtphnCCynekt8UBvpVKHUU/xaUa09TQTToXjBbV1SZeIOHNG0MNbWa4sz
-    AL/cpXdq1EAxiTeAVT9XhCwhe/xJvFZIWuFLmW3J+ZxrOUCKieCYpTqBY2tBkkDY
-    //egic787yTR6zxqQNSzvNU5LhzrN7lu+KHGM06T35+HvpzgPPiRCzsxO62p63op
-    mq04K31yYZgLiqeAj5W+rioRGJNn4TXJpH9KIrzmGM7lVWLYWMAKeZU4r1lDUdcu
-    7jsBH8BRJWJeVK3xVw2HB3lk7Xn0WrR92adeYQ3f0vKbMIAVUnSJ3yCKJ4NMFSki
-    j78nx2mi/G0RhUPGZ9hhLXQKj9BtbpEnwpbGWtf0ShtVOxD/HKLCr7koBtW9TMPS
-    9K0sJhE5VjsQLkDDu9p3GdRcuLNA/oa7xFvRFtqGFsLj
-    -----END CERTIFICATE-----

apps/django/wb/kustomization.yaml

@@ -1,20 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: django
-resources:
-  - django-configmap.yaml
-  - uwsgi-configmap.yaml
-  - zitadel-configmap.yaml
-  - nginx-configmap.yaml
-  - kafka-cert-configmap.yaml
-  - backend.yaml
-  - celery.yaml
-  - export-project.yaml
-  - frontend.yaml
-  - gatekeeper.yaml
-  - measurement.yaml
-  - redis.yaml
-  - s3-proxy.yaml
-  - srx-admin.yaml
-  - auth-flow-frontend.yaml

apps/django/wb/measurement.yaml

@@ -1,112 +0,0 @@
----
-# measurement — компонент приложения measurements (apps/measurements),
-# в wb развёрнут в ns django, а не в своём собственном неймспейсе.
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: measurement
-  namespace: django
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      measurement:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/measurements:prod_ece72657
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: measurement
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 8000
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: true
-
-          name:
-            _default: measurement-service
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 8000
-
-          targetPort:
-            _default: 8000
-
-          portName:
-            _default: http
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        volumes:
-          _default:
-            - name: tmp-volume
-              mountPath:
-                _default: /tmp
-              emptyDir: {}
-
-        envs:
-          - name: DJANGO_HOST
-            value:
-              _default: "https://lk.srx.wb.ru:30443"
-
-          - name: S3_JSON_FILE
-            value:
-              _default: "/opt/cred_s3.json"
-
-        secretEnvs:
-          - name: S3_JSON_SETTINGS
-            secretName:
-              _default: "s3-json-settings"
-            secretKey: "S3_JSON_SETTINGS"
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/django/wb/nginx-configmap.yaml

@@ -1,180 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: nginx-configmap
-  namespace: django
-data:
-  nginx.conf: |
-    worker_processes auto;
-
-    pid /var/run/nginx.pid;
-
-    events {
-        use epoll;
-        worker_connections 1024;
-    }
-
-    http {
-
-        # Basic Settings
-        large_client_header_buffers 8 128k;
-        sendfile on;
-        tcp_nopush on;
-        tcp_nodelay on;
-        keepalive_timeout 300;
-        types_hash_max_size 2048;
-        client_max_body_size 5000M;
-        client_header_buffer_size 5M;
-        # server_tokens off;
-        # server_names_hash_bucket_size 64;
-        # server_name_in_redirect off;
-        include /etc/nginx/mime.types;
-        default_type application/octet-stream;
-
-        # Logging Settings
-        access_log /var/log/nginx/access.log;
-        error_log /var/log/nginx/error.log;
-
-        # GZIP Settings
-        gzip on;
-        gzip_vary on;
-        gzip_proxied any;
-        gzip_comp_level 6;
-        gzip_buffers 16 8k;
-        gzip_http_version 1.1;
-        gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
-
-        log_format main '$remote_addr - $remote_user [$time_local] "$request" '
-                        '$status $body_bytes_sent "$http_referer" '
-                        '"$http_user_agent" "$http_x_forwarded_for"';
-
-        server {
-            listen 80;
-            listen [::]:80;
-            root /opt/react_client/;
-
-            add_header 'Access-Control-Allow-Origin' '*' always;
-            add_header 'Access-Control-Allow-Methods' '*' always;
-            add_header 'Access-Control-Allow-Headers' '*' always;
-
-            location = /static/index.bundle.js {
-                add_header Cache-Control 'no-store no-cache, must-revalidate, proxy-revalidate, max-age=0';
-                if_modified_since off;
-                expires off;
-            }
-
-            location = /static/pdf-runtime/assets/mupdf-wasm.wasm {
-                alias /opt/react_client/static/pdf-runtime/assets/mupdf-wasm.wasm;
-                add_header Content-Type application/wasm always;
-                add_header Cache-Control "public, max-age=31536000, immutable" always;
-                add_header Access-Control-Allow-Origin "*" always;
-                add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
-                add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
-            }
-
-            location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.js {
-                alias /opt/react_client/static/viewer-pdf/mupdf-wasm.js;
-                add_header Content-Type application/javascript always;
-                add_header Cache-Control "public, max-age=31536000, immutable" always;
-                add_header Access-Control-Allow-Origin "*" always;
-                add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
-                add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
-            }
-
-            location = /workspaces-v2/worker/mupdf.worker-3.3.9.js {
-                alias /opt/react_client/static/pdf-runtime/mupdf.worker-3.3.9.js;
-                add_header Content-Type application/javascript always;
-                add_header Cache-Control "public, max-age=31536000, immutable" always;
-                add_header Access-Control-Allow-Origin "*" always;
-                add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
-                add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
-            }
-
-            location = /workspaces-v2/worker/static/viewer-pdf/mupdf.js {
-                alias /opt/react_client/static/viewer-pdf/mupdf.js;
-                add_header Content-Type application/javascript always;
-                add_header Cache-Control "public, max-age=31536000, immutable" always;
-                add_header Access-Control-Allow-Origin "*" always;
-                add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
-                add_header Access-Control-Allow-Headers "DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
-            }
-
-            location = /workspaces-v2/worker/static/viewer-pdf/mupdf-wasm.wasm {
-                add_header Content-Type application/wasm always;
-                alias /opt/react_client/static/viewer-pdf/mupdf-wasm.wasm;
-            }
-            location ~^/api/pm/ {
-                #rewrite /api/(.+) /$1 break;
-                proxy_set_header Host $host;
-                proxy_pass http://backend-service.pm.svc.cluster.local:8000;
-            }
-
-            location ~^/media/ {
-                rewrite ^/media/(.*)$ /$1 break;
-                proxy_set_header Host $host;
-                proxy_pass http://s3-proxy-service:80;
-            }
-
-            location ~^/api/v1/documents/ {
-                #rewrite /api/(.+) /$1 break;
-                proxy_set_header Host $host;
-                proxy_pass http://documentations-filestream.documentations.svc.cluster.local:8080;
-            }
-
-            location ~^/(api|admin)/ {
-                proxy_set_header Host $host;
-                proxy_pass http://backend:8000;
-            }
-
-            # location ~^/flows/static/ {
-            #      rewrite /flows/static/(.+) /$1 break;
-            #      proxy_pass http://frontend-service.flows:80;
-            # }
-
-            #  location = ~^/orchestrator/ {
-            # rewrite ^/orchestrator$ /api/ break;
-            # proxy_pass http://cde.orchestrator.svc.cluster.local:8080;
-            # }
-
-            # location = ~^/orchestrator/api/process {
-            #     rewrite ^/orchestrator/api/process$ /api/process break;
-            #     proxy_pass http://cde.orchestrator.svc.cluster.local:8080;
-            # }
-
-            # location ~ ^/orchestrator/api/process/(.*)$ {
-            #     rewrite ^/orchestrator/api/process/(.*)$ /api/process/$1 break;
-            #     proxy_pass http://cde.orchestrator.svc.cluster.local:8080;
-            # }
-
-            # location = ~^/orchestrator/api/sign {
-            #     rewrite ^/orchestrator/api/sign$ /api/sign break;
-            #     proxy_pass http://cde.orchestrator.svc.cluster.local:8080;
-            # }
-
-
-            location ~^/workspaces-v2/(.+).js {
-                rewrite /workspaces-v2/(.+) /$1 break;
-                proxy_pass http://workspaces-v2-frontend-static-service.workspaces.svc.cluster.local:8080;
-            }
-
-            location @index {
-                add_header Cache-Control 'no-cache, must-revalidate, proxy-revalidate, max-age=0';
-                if_modified_since off;
-                expires off;
-                try_files /static/index.html =404;
-            }
-
-            location ~^/workflows/(.+).js {
-                 rewrite /workflows/(.+) /$1 break;
-                 proxy_pass http://frontend-service.workflow.svc.cluster.local:8080;
-            }
-            location /service-worker.js {
-                try_files /static/$uri @index;
-            }
-
-            location / {
-                try_files $uri @index;
-            }
-        }
-    }

apps/django/wb/redis.yaml

@@ -1,88 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: redis
-  namespace: django
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      redis:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/redis:latest
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: redis
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 6379
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: true
-
-          name:
-            _default: redis-service
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 6379
-
-          targetPort:
-            _default: 6379
-
-          portName:
-            _default: tcp
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/django/wb/s3-proxy.yaml

@@ -1,117 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: s3-proxy
-  namespace: django
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      s3-proxy:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/s3-proxy:stable
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: s3-proxy
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 80
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: true
-
-          name:
-            _default: s3-proxy-service
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 80
-
-          targetPort:
-            _default: 80
-
-          portName:
-            _default: http
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        envs:
-          - name: AWS_API_ENDPOINT
-            value:
-              _default: "http://10.49.10.90:9000"
-
-          - name: ACCESS_LOG
-            value:
-              _default: "true"
-
-          - name: CORS_ALLOW_HEADERS
-            value:
-              _default: "Content-Type, Accept-Ranges, Content-Range, Content-Encoding"
-
-        secretEnvs:
-          - name: AWS_ACCESS_KEY_ID
-            secretName:
-              _default: "sarex-media-storage-secret"
-            secretKey: "login"
-
-          - name: AWS_SECRET_ACCESS_KEY
-            secretName:
-              _default: "sarex-media-storage-secret"
-            secretKey: "password"
-
-          - name: AWS_S3_BUCKET
-            secretName:
-              _default: "sarex-media-storage-secret"
-            secretKey: "bucket"
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/django/wb/srx-admin.yaml

@@ -1,95 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: srx-admin
-  namespace: django
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      srx-admin:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/srx-admin:prod_638c3442
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: srx-admin
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 80
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: true
-
-          name:
-            _default: srx-admin-svc
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 8080
-
-          targetPort:
-            _default: 80
-
-          portName:
-            _default: http
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        volumes:
-          _default:
-            - name: tmp-volume
-              mountPath:
-                _default: /tmp
-              emptyDir: {}
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/django/wb/uwsgi-configmap.yaml

@@ -1,31 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: uwsgi-configmap
-  namespace: django
-data:
-  uwsgi.ini: |
-    [uwsgi]
-    module                 = config.wsgi:application
-    DJANGO_SETTINGS_MODULE = config.settings.production
-    http                   = 0.0.0.0:8000
-    processes              = 16
-    master                 = true
-    vacuum                 = true
-    enable-threads         = true
-    buffer-size            = 65535
-    stats                  = :3031
-    stats-http             = true
-    memory-report          = true
-    lazy-apps              = true
-    listen                 = 128
-    disable-write-exception= 0
-    harakiri               = 300
-    socket-timeout         = 300
-    chunked-input-timeout  = 300
-    http-timeout           = 300
-    worker-reload-mercy    = 240
-    mule-reload-mercy      = 240
-    static-map = /static=/opt/sarex/sarex/static/
-    static-map = /media=/media/

apps/django/wb/zitadel-configmap.yaml

@@ -1,15 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: zitadel-configmap
-  namespace: django
-data:
-  config.json: |-
-    {
-      "auth_type": "zitadel",
-      "zitadel": {
-        "client_id": "363741990556356237",
-        "host": "https://zitadel-srx.wb.ru"
-      }
-    }

apps/documentations/base/pdm.yaml

@@ -64,7 +64,7 @@ spec:
               enabled: false
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/pdmv2:prod_9507c2d5
+            _default: cr.yandex/crp3ccidau046kdj8g9q/pdmv2:prod_38958427
           pullPolicy:
             _default: IfNotPresent
         service:
@@ -183,7 +183,7 @@ spec:
               _default: INFO
           - name: NOTES_URL
             value:
-              _default: "mock"
+              _default: ""
           - name: OBSERVABILITY_COLLECTOR_ENDPOINT
             value:
               _default: temp

apps/documentations/brusnika-prod/api.yaml

@@ -212,10 +212,6 @@ spec:
             value:
               _default: "v1"
 
-          - name: USE_MARKS_RABBITMQ
-            value:
-              _default: "true"
-
           - name: SYSTEM_LOG_URL
             value:
               _default: "http://api-service.system-log.svc.cluster.local:80"
@@ -298,32 +294,6 @@ spec:
               _default: "django-auth"
             secretKey: "key"
 
-          - name: MARKS_RABBITMQ_HOST
-            secretName:
-              _default: "rabbitmq"
-            secretKey: "host"
-          
-          - name: MARKS_RABBITMQ_PASSWORD
-            secretName:
-              _default: "rabbitmq"
-            secretKey: "password"
-          
-          - name: MARKS_RABBITMQ_USER
-            secretName:
-              _default: "rabbitmq"
-            secretKey: "username"
-
-          - name: MARKS_RABBITMQ_API
-            secretName:
-              _default: "rabbitmq"
-            secretKey: "vhost"
-          
-          - name: MARKS_RABBITMQ_PORT
-            secretName:
-              _default: "rabbitmq"
-            secretKey: "port"
-
-
           - name: DJANGO_BASIC_AUTH_FOR_GET_USER
             secretName:
               _default: "django-auth"

apps/documentations/brusnika-prod/hasher.yaml

@@ -1,186 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: documentations-hasher
-  namespace: documentations
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-  driftDetection:
-    mode: enabled
-
-  values:
-    global:
-      env: _default
-
-    services:
-      backend:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/hasher:production_3f853d3a
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: hasher
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 8080
-
-          command:
-            _default: ["run-amqp-server"]
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: true
-
-          name:
-            _default: hasher-service
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 8080
-
-          targetPort:
-            _default: 8080
-
-          portName:
-            _default: http
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: regcred
-
-        labels:
-          monitoring: prometheus
-
-        envs:
-          - name: HASHER_APP__LOG_LEVEL
-            value:
-              _default: "INFO"
-
-          - name: HASHER_APP__NUM_WORKERS
-            value:
-              _default: "4"
-
-          - name: HASHER_AMQP__ROUTING__TASK_INPUT_QUEUE
-            value:
-              _default: "hash.compute.normal.tasks"
-
-          - name: HASHER_AMQP__ROUTING__TASK_INPUT_EXCHANGE
-            value:
-              _default: "hash.compute"
-
-          - name: HASHER_AMQP__ROUTING__TASK_INPUT_EXCHANGE_TYPE
-            value:
-              _default: "direct"
-
-          - name: HASHER_AMQP__ROUTING__TASK_INPUT_ROUTING_KEY
-            value:
-              _default: "hash.compute.normal"
-
-          - name: HASHER_S3__MAX_POOL_CONNECTIONS
-            value:
-              _default: "10"
-
-          - name: HASHER_S3__CONNECT_TIMEOUT
-            value:
-              _default: "10"
-
-          - name: HASHER_S3__READ_TIMEOUT
-            value:
-              _default: "30"
-
-          - name: HASHER_S3__REGION_NAME
-            value:
-              _default: "ru-central1"
-
-          - name: HASHER_S3__USE_SSL
-            value:
-              _default: "true"
-
-          - name: HASHER_S3__VERIFY
-            value:
-              _default: "true"
-
-        secretEnvs:
-          - name: HASHER_AMQP__HOST
-            secretName:
-              _default: "rabbitmq"
-            secretKey: "host"
-
-          - name: HASHER_AMQP__PORT
-            secretName:
-              _default: "rabbitmq"
-            secretKey: "port"
-
-          - name: HASHER_AMQP__USERNAME
-            secretName:
-              _default: "rabbitmq"
-            secretKey: "username"
-
-          - name: HASHER_AMQP__PASSWORD
-            secretName:
-              _default: "rabbitmq"
-            secretKey: "password"
-
-          - name: HASHER_AMQP__VHOST
-            secretName:
-              _default: "rabbitmq"
-            secretKey: "vhost"
-
-          - name: HASHER_S3__ENDPOINT
-            secretName:
-              _default: "hasher-s3-secret"
-            secretKey: "endpoint"
-
-          - name: HASHER_S3__ACCESS_KEY
-            secretName:
-              _default: "hasher-s3-secret"
-            secretKey: "access_key"
-
-          - name: HASHER_S3__SECRET_KEY
-            secretName:
-              _default: "hasher-s3-secret"
-            secretKey: "secret_key"
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/documentations/brusnika-prod/kustomization.yaml

@@ -7,4 +7,3 @@ resources:
   - pdm.yaml
   - api.yaml
   - filestream.yaml
-  - hasher.yaml

apps/documentations/wb/api.yaml

@@ -1,335 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: documentations-api
-  namespace: documentations
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      documentations-api:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations:prod_179e518c
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: documentations-api
-
-          replicaCount:
-            _default: 3
-
-          port:
-            _default: 8080
-
-          resources:
-            requests:
-              cpu:
-                _default: 300m
-              memory:
-                _default: 300Mi
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: true
-
-          name:
-            _default: documentations-api
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 8080
-
-          targetPort:
-            _default: 8080
-
-          portName:
-            _default: http
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        volumes:
-          _default:
-            - name: documentations-yc-s3-secret
-              mountPath:
-                _default: /etc/sarex/yc-s3-storage
-              readOnly:
-                _default: true
-              secret:
-                secretName:
-                  _default: documentations-yc-s3
-
-            - name: zitadel-account
-              mountPath:
-                _default: /etc/sarex/zitadel
-              readOnly:
-                _default: true
-              secret:
-                secretName:
-                  _default: zitadel-account
-
-        envs:
-          - name: POSTGRES_ADDRESS
-            value:
-              _default: "sarex-vpsql-01.xc.wb.ru"
-
-          - name: POSTGRES_PORT
-            value:
-              _default: "5432"
-
-          - name: POSTGRES_DB
-            value:
-              _default: "documentations_db"
-
-          - name: POSTGRES_POOL_SIZE
-            value:
-              _default: "20"
-
-          - name: ZITADEL_ACCOUNT
-            value:
-              _default: "/etc/sarex/zitadel/zitadel-account.json"
-
-          - name: ZITADEL_DOMAIN
-            value:
-              _default: "zitadel-srx.wb.ru"
-
-          - name: USE_ZITADEL
-            value:
-              _default: "1"
-
-          - name: FLOWS_URL
-            value:
-              _default: "http://backend-service.flows.svc.cluster.local:8000"
-
-          - name: LAST_MASTER_BIM
-            value:
-              _default: "36311"
-
-          - name: API_ADDRESS
-            value:
-              _default: "0.0.0.0:8080"
-
-          - name: API_ADDRESS_FILE
-            value:
-              _default: "0.0.0.0:8080"
-
-          - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES
-            value:
-              _default: "5"
-
-          - name: ENABLE_SQL_QUERY
-            value:
-              _default: "0"
-
-          - name: ENABLE_SSL
-            value:
-              _default: "0"
-
-          - name: WORKSPACE_V2_EXTERNAL_URL
-            value:
-              _default: "https://srx.wb.ru/workspaces-v2/"
-
-          - name: ENABLE_S3
-            value:
-              _default: "1"
-
-          - name: CONTAINER_REGISTRY
-            value:
-              _default: "cr.yandex/crp3ccidau046kdj8g9q"
-
-          - name: ENVIRONMENT
-            value:
-              _default: "production"
-
-          - name: LAST_SLAVE_1_BIM
-            value:
-              _default: "1000000"
-
-          - name: HOST
-            value:
-              _default: "http://documentations-api.documentations.svc.cluster.local:8080"
-
-          - name: FILE_STREAM_HOST
-            value:
-              _default: "srx.wb.ru"
-
-          - name: DOCUMENTATION_URL
-            value:
-              _default: "http://documentations-api.documentations.svc.cluster.local:8080/"
-
-          - name: WORKFLOW_URL
-            value:
-              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000/"
-
-          - name: WORKSPACE_URL
-            value:
-              _default: "http://workspaces-service.workspaces.svc.cluster.local:8000/"
-
-          - name: BIM_API_URL
-            value:
-              _default: "http://bim-api-service.bim.svc.cluster.local:8080/"
-
-          - name: BIM_API_V2_URL
-            value:
-              _default: "http://backend-service.bim.svc.cluster.local:8000/"
-
-          - name: WORKSPACE_BUNDLE_VERSION
-            value:
-              _default: "v1"
-
-          - name: SYSTEM_LOG_URL
-            value:
-              _default: "http://api-service.system-log.svc.cluster.local:8000"
-
-          - name: DJANGO_HOST
-            value:
-              _default: "http://backend.django.svc.cluster.local:8000"
-
-          - name: MARKS_PROCESSING_URL
-            value:
-              _default: "http://marks-service:8000"
-
-          - name: PUBLIC_LINK_HOST
-            value:
-              _default: "https://document-link-srx.wb.ru"
-
-          - name: NAMESPACE
-            value:
-              _default: "documentations"
-
-          - name: DJANGO_ORIGINATOR
-            value:
-              _default: "docs_prod"
-
-          - name: WORKFLOW_IMAGES_VERSION
-            value:
-              _default: "master"
-
-          - name: WORKFLOWS_IMAGES_VERSION
-            value:
-              _default: "master"
-
-          - name: S3_SERVICE_ACCOUNT
-            value:
-              _default: "/etc/sarex/yc-s3-storage/yc-s3-service-account.json"
-
-          - name: READ_WRITE_TIMEOUT_FILE_STREAM
-            value:
-              _default: "6h"
-
-          - name: CACHE_DEFAULT_EXPIRATION
-            value:
-              _default: "60s"
-
-          - name: ENABLE_SMTP
-            value:
-              _default: "True"
-
-          - name: ENABLE_MAILGUN
-            value:
-              _default: "False"
-
-          - name: CACHE_CLEANUP_INTERVAL
-            value:
-              _default: "60s"
-
-          - name: ENABLE_AUTH_JWT_IN_URL
-            value:
-              _default: "false"
-
-          - name: ENABLE_SIGNATURE_IN_URL
-            value:
-              _default: "true"
-
-          - name: USE_CACHE_IN_FILE_STREAMER
-            value:
-              _default: "1"
-
-          - name: VALKEY_ADDR
-            value:
-              _default: "redis:6379"
-
-          - name: VALKEY_HOST
-            value:
-              _default: "redis"
-
-          - name: VALKEY_PORT
-            value:
-              _default: "6379"
-
-        secretEnvs:
-          - name: PUBLIC_KEY
-            secretName:
-              _default: "public-key"
-            secretKey: "key"
-
-          - name: DOCUMENT_PUBLIC_LINK_JWT_SECRET
-            secretName:
-              _default: "yc-jwt-secret"
-            secretKey: "secret"
-
-          - name: POSTGRES_USER
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "username"
-
-          - name: POSTGRES_PASSWORD
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "password"
-
-          - name: DJANGO_BASIC_AUTH
-            secretName:
-              _default: "django-auth"
-            secretKey: "key"
-
-          - name: DJANGO_BASIC_AUTH_FOR_GET_USER
-            secretName:
-              _default: "django-auth"
-            secretKey: "key"
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/documentations/wb/filestream.yaml

@@ -1,292 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: documentations-filestream
-  namespace: documentations
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      documentations-filestream:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentations-api-files:prod_3f19a21d
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: documentations-filestream
-
-          replicaCount:
-            _default: 3
-
-          port:
-            _default: 8080
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: true
-
-          name:
-            _default: documentations-filestream
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 8080
-
-          targetPort:
-            _default: 8080
-
-          portName:
-            _default: http
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        volumes:
-          _default:
-            - name: documentations-yc-s3-secret
-              mountPath:
-                _default: /etc/sarex/yc-s3-storage
-              readOnly:
-                _default: true
-              secret:
-                secretName:
-                  _default: documentations-yc-s3
-
-            - name: zitadel-account
-              mountPath:
-                _default: /etc/sarex/zitadel
-              readOnly:
-                _default: true
-              secret:
-                secretName:
-                  _default: zitadel-account
-
-        envs:
-          - name: POSTGRES_ADDRESS
-            value:
-              _default: "sarex-vpsql-01.xc.wb.ru"
-
-          - name: POSTGRES_PORT
-            value:
-              _default: "5432"
-
-          - name: POSTGRES_DB
-            value:
-              _default: "documentations_db"
-
-          - name: POSTGRES_POOL_SIZE
-            value:
-              _default: "20"
-
-          - name: API_ADDRESS
-            value:
-              _default: "0.0.0.0:8080"
-
-          - name: API_ADDRESS_FILE
-            value:
-              _default: "0.0.0.0:8080"
-
-          - name: ENABLE_SQL_QUERY
-            value:
-              _default: "0"
-
-          - name: ENABLE_SSL
-            value:
-              _default: "0"
-
-          - name: ENABLE_S3
-            value:
-              _default: "1"
-
-          - name: ZITADEL_ACCOUNT
-            value:
-              _default: "/etc/sarex/zitadel/zitadel-account.json"
-
-          - name: ZITADEL_DOMAIN
-            value:
-              _default: "zitadel-srx.wb.ru"
-
-          - name: USE_ZITADEL
-            value:
-              _default: "1"
-
-          - name: CONTAINER_REGISTRY
-            value:
-              _default: "cr.yandex/crp3ccidau046kdj8g9q"
-
-          - name: ENVIRONMENT
-            value:
-              _default: "production"
-
-          - name: HOST
-            value:
-              _default: "http://documentations-service.documentations.svc.cluster.local:8080"
-
-          - name: FILE_STREAM_HOST
-            value:
-              _default: "srx.wb.ru"
-
-          - name: DOCUMENTATION_URL
-            value:
-              _default: "http://documentations-service.documentations.svc.cluster.local:8080/"
-
-          - name: WORKFLOW_URL
-            value:
-              _default: "http://workflows-service.workflow.svc.cluster.local:8000/"
-
-          - name: WORKSPACE_URL
-            value:
-              _default: "http://workspaces-service.workspaces.svc.cluster.local:8000/"
-
-          - name: BIM_API_URL
-            value:
-              _default: "http://bim-api-service.bim.svc.cluster.local:8080/"
-
-          - name: BIM_API_V2_URL
-            value:
-              _default: "http://backend-service.bim.svc.cluster.local:8000/"
-
-          - name: ENABLE_AUTH_JWT_IN_URL
-            value:
-              _default: "false"
-
-          - name: ENABLE_SIGNATURE_IN_URL
-            value:
-              _default: "true"
-
-          - name: WORKSPACE_BUNDLE_VERSION
-            value:
-              _default: "v1"
-
-          - name: DOCUMENT_PUBLIC_LINK_JWT_EXPIRATION_MINUTES
-            value:
-              _default: "5"
-
-          - name: DJANGO_HOST
-            value:
-              _default: "http://backend.django.svc.cluster.local:8000"
-
-          - name: NAMESPACE
-            value:
-              _default: "sarex-documentations"
-
-          - name: DJANGO_ORIGINATOR
-            value:
-              _default: "docs_prod"
-
-          - name: WORKFLOW_IMAGES_VERSION
-            value:
-              _default: "master"
-
-          - name: WORKFLOWS_IMAGES_VERSION
-            value:
-              _default: "master"
-
-          - name: S3_SERVICE_ACCOUNT
-            value:
-              _default: "/etc/sarex/yc-s3-storage/yc-s3-service-account.json"
-
-          - name: READ_WRITE_TIMEOUT_FILE_STREAM
-            value:
-              _default: "6h"
-
-          - name: CACHE_DEFAULT_EXPIRATION
-            value:
-              _default: "60s"
-
-          - name: CACHE_CLEANUP_INTERVAL
-            value:
-              _default: "60s"
-
-          - name: USE_CACHE_IN_FILE_STREAMER
-            value:
-              _default: "1"
-
-          - name: VALKEY_ADDR
-            value:
-              _default: "redis:6379"
-
-          - name: VALKEY_HOST
-            value:
-              _default: "redis"
-
-          - name: VALKEY_PORT
-            value:
-              _default: "6379"
-
-        secretEnvs:
-          - name: DJANGO_BASIC_AUTH_FOR_GET_USER
-            secretName:
-              _default: "django-auth"
-            secretKey: "key"
-
-          - name: DOCUMENT_PUBLIC_LINK_JWT_SECRET
-            secretName:
-              _default: "yc-jwt-secret"
-            secretKey: "secret"
-
-          - name: POSTGRES_USER
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "username"
-
-          - name: POSTGRES_PASSWORD
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "password"
-
-          - name: DJANGO_BASIC_AUTH
-            secretName:
-              _default: "django-auth"
-            secretKey: "key"
-
-          - name: PUBLIC_KEY
-            secretName:
-              _default: "public-key"
-            secretKey: "key"
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/documentations/wb/frontend-public-link.yaml

@@ -1,113 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: frontend-public-link
-  namespace: documentations
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      frontend-public-link:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/document-link-frontend:wb_cb2027ce
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: frontend-public-link
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 3000
-
-          command:
-            _default: ["npm", "start"]
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: true
-
-          name:
-            _default: frontend-service-public-link
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 80
-
-          targetPort:
-            _default: 3000
-
-          portName:
-            _default: http
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        volumes:
-          _default:
-            - name: envfile
-              mountPath:
-                _default: /app/.env.local
-              subPath:
-                _default: .env.local
-              readOnly:
-                _default: true
-              secret:
-                secretName:
-                  _default: documentations-publiclink-jwt-secret
-                items:
-                  - key: .env
-                    path:
-                      _default: .env.local
-
-        envs:
-          - name: NODE_ENV
-            value:
-              _default: "production"
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/documentations/wb/frontend-static.yaml

@@ -1,88 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: documentation-frontend-static
-  namespace: documentations
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      documentation-frontend-static:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/documentation-frontend-app:brusnika_e5f99d7c
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: documentation-frontend-static
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 80
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: true
-
-          name:
-            _default: documentation-frontend-static-service
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 80
-
-          targetPort:
-            _default: 80
-
-          portName:
-            _default: http
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/documentations/wb/kustomization.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: documentations
-resources:
-  - api.yaml
-  - filestream.yaml
-  - pdm-api.yaml
-  - pdf-markings.yaml
-  - pdf-markings-amqp.yaml
-  - frontend-public-link.yaml
-  - frontend-static.yaml
-  - redis.yaml
-  - stamp-verification.yaml

apps/documentations/wb/pdf-markings-amqp.yaml

@@ -1,193 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: pdf-markings-amqp
-  namespace: documentations
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      api:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings-amqp:prod_3ab263be
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: pdf-markings-amqp
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 8000
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: false
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        volumes:
-          _default:
-            - name: yc-s3
-              mountPath:
-                _default: /etc/sarex/yc-s3-storage
-              readOnly:
-                _default: true
-              secret:
-                secretName:
-                  _default: yc-s3
-
-        envs:
-          - name: MARKS_APP__LOG_LEVEL
-            value:
-              _default: "INFO"
-
-          - name: MARKS_CRYPTO__HASHING_ALGO
-            value:
-              _default: "md_gost12_256"
-
-          - name: MARKS_DOCUMENTS_DB__HOST
-            value:
-              _default: "sarex-vpsql-01.xc.wb.ru"
-
-          - name: MARKS_DOCUMENTS_DB__PORT
-            value:
-              _default: "5432"
-
-          - name: MARKS_DOCUMENTS_DB__DATABASE
-            value:
-              _default: "documentations_db"
-
-          - name: MARKS_DOCUMENTS_DB__SSLMODE
-            value:
-              _default: "disable"
-
-          - name: MARKS_QR__REDIRECT_URL
-            value:
-              _default: "https://stamp-verification-srx.wb.ru/"
-
-          - name: MARKS_QR__BASE_DOCUMENT_URL
-            value:
-              _default: "https://srx.wb.ru"
-
-          - name: MARKS_S3__USE_SSL
-            value:
-              _default: "false"
-
-          - name: MARKS_S3__SSL_VERIFY
-            value:
-              _default: "false"
-
-          - name: MARKS_S3__REGION
-            value:
-              _default: "ru-central1"
-
-          - name: MARKS_S3__DEFAULT_BUCKET
-            value:
-              _default: "documentations-stage-1-sarex-new"
-
-          - name: MARKS_RABBITMQ__ROUTING__INPUT_QUEUE
-            value:
-              _default: "pdf_markings_input"
-
-        secretEnvs:
-          - name: MARKS_DOCUMENTS_DB__USERNAME
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "username"
-
-          - name: MARKS_DOCUMENTS_DB__PASSWORD
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "password"
-
-          - name: MARKS_S3__URL
-            secretName:
-              _default: "yc-s3"
-            secretKey: "endpoint_url"
-
-          - name: MARKS_S3__ACCESS_KEY
-            secretName:
-              _default: "yc-s3"
-            secretKey: "key_id"
-
-          - name: MARKS_S3__SECRET_KEY
-            secretName:
-              _default: "yc-s3"
-            secretKey: "access_key"
-
-          - name: MARKS_RABBITMQ__HOST
-            secretName:
-              _default: "rabbitmq"
-            secretKey: "host"
-
-          - name: MARKS_RABBITMQ__PORT
-            secretName:
-              _default: "rabbitmq"
-            secretKey: "port"
-
-          - name: MARKS_RABBITMQ__USERNAME
-            secretName:
-              _default: "rabbitmq"
-            secretKey: "username"
-
-          - name: MARKS_RABBITMQ__PASSWORD
-            secretName:
-              _default: "rabbitmq"
-            secretKey: "password"
-
-          - name: MARKS_RABBITMQ__VHOST
-            secretName:
-              _default: "rabbitmq"
-            secretKey: "vhost"
-
-          - name: MARKS_RABBITMQ__HEARTBEAT_SECONDS
-            secretName:
-              _default: "rabbitmq"
-            secretKey: "heartbeat"
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/documentations/wb/pdf-markings.yaml

@@ -1,231 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: pdf-markings
-  namespace: documentations
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      pdf-markings:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/pdf-markings:prod_7d892636
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: pdf-markings
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 8000
-
-          resources:
-            requests:
-              cpu:
-                _default: "2"
-              memory:
-                _default: 8Gi
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: true
-
-          name:
-            _default: marks-service
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 8000
-
-          targetPort:
-            _default: 8000
-
-          portName:
-            _default: http
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        volumes:
-          _default:
-            - name: yc-s3
-              mountPath:
-                _default: /etc/sarex/yc-s3-storage
-              readOnly:
-                _default: true
-              secret:
-                secretName:
-                  _default: documentations-yc-s3
-
-        envs:
-          - name: APP_NAME
-            value:
-              _default: "pdm_v2"
-
-          - name: VERIFY
-            value:
-              _default: "False"
-
-          - name: APP_VERSION
-            value:
-              _default: "0.0.1"
-
-          - name: LOG_LEVEL
-            value:
-              _default: "INFO"
-
-          - name: HTTP_PORT
-            value:
-              _default: "8000"
-
-          - name: DOC_POSTGRES_HOST
-            value:
-              _default: "sarex-vpsql-01.xc.wb.ru"
-
-          - name: DOC_POSTGRES_PORT
-            value:
-              _default: "5432"
-
-          - name: DOC_POSTGRES_DB
-            value:
-              _default: "documentations_db"
-
-          - name: DOC_POSTGRES_POOL_SIZE
-            value:
-              _default: "10"
-
-          - name: DOC_POSTGRES_SSL_MODE
-            value:
-              _default: "disable"
-
-          - name: API_ADDRESS
-            value:
-              _default: "0.0.0.0:8000"
-
-          - name: DATABASE_SSL_MODE
-            value:
-              _default: "disable"
-
-          - name: YANDEX_S3_USE_SSL
-            value:
-              _default: "0"
-
-          - name: ENVIRONMENT
-            value:
-              _default: "production"
-
-          - name: YANDEX_S3_ACCOUNT_PATH
-            value:
-              _default: "/etc/sarex/yc-s3-storage/yc-s3-service-account.json"
-
-          - name: REDIRECT_URL_QR
-            value:
-              _default: "https://stamp-verification-srx.wb.ru/"
-
-          - name: BASE_DOCUMENT_URL
-            value:
-              _default: "https://srx.wb.ru"
-
-        secretEnvs:
-          - name: DOC_POSTGRES_USER
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "username"
-
-          - name: DOC_POSTGRES_PASSWORD
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "password"
-
-          - name: YANDEX_S3_ENDPOINT_URL
-            secretName:
-              _default: "yc-s3"
-            secretKey: "endpoint_url"
-
-          - name: YANDEX_S3_SECRET_ACCESS_KEY
-            secretName:
-              _default: "yc-s3"
-            secretKey: "access_key"
-
-          - name: YANDEX_S3_ACCESS_KEY_ID
-            secretName:
-              _default: "yc-s3"
-            secretKey: "key_id"
-
-          - name: RABBITMQ_HOST
-            secretName:
-              _default: "rabbitmq"
-            secretKey: "host"
-
-          - name: RABBITMQ_PORT
-            secretName:
-              _default: "rabbitmq"
-            secretKey: "port"
-
-          - name: RABBITMQ_USERNAME
-            secretName:
-              _default: "rabbitmq"
-            secretKey: "username"
-
-          - name: RABBITMQ_PASSWORD
-            secretName:
-              _default: "rabbitmq"
-            secretKey: "password"
-
-          - name: RABBITMQ_VHOST
-            secretName:
-              _default: "rabbitmq"
-            secretKey: "vhost"
-
-          - name: RABBITMQ_HEARTBEAT
-            secretName:
-              _default: "rabbitmq"
-            secretKey: "heartbeat"
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/documentations/wb/pdm-api.yaml

@@ -1,346 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: pdm-api
-  namespace: documentations
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      pdm-api:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/pdmv2:prod_9507c2d5
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: pdm-api
-
-          replicaCount:
-            _default: 3
-
-          port:
-            _default: 8080
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: true
-
-          name:
-            _default: pdm-api
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 8080
-
-          targetPort:
-            _default: 8080
-
-          portName:
-            _default: http
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        volumes:
-          _default:
-            - name: documentations-yc-s3-secret
-              mountPath:
-                _default: /etc/sarex/yc-s3-storage
-              readOnly:
-                _default: true
-              secret:
-                secretName:
-                  _default: documentations-yc-s3
-
-        envs:
-          - name: USE_EXPERIMENTAL
-            value:
-              _default: "true"
-
-          - name: API_ADDRESS
-            value:
-              _default: "0.0.0.0:8080"
-
-          - name: API_ADDRESS_FILE
-            value:
-              _default: "0.0.0.0:8080"
-
-          - name: BUCKET_NAME
-            value:
-              _default: "attachments-storage"
-
-          - name: API_HOST_PREFIX
-            value:
-              _default: "/"
-
-          - name: APP_NAME
-            value:
-              _default: "pdm_v2"
-
-          - name: APP_VERSION
-            value:
-              _default: "0.0.1"
-
-          - name: ENABLE_PERMISSIONS_FILTER
-            value:
-              _default: "1"
-
-          - name: PERMISSIONS_FILTER_COMPANIES
-            value:
-              _default: "[1]"
-
-          - name: TRANSMITTALS_ENABLE
-            value:
-              _default: "false"
-
-          - name: DRAWINGS_INTERNAL_URL
-            value:
-              _default: "http://drawings-api-service.drawings.svc.cluster.local:80"
-
-          - name: ATTACHMENTS_URL
-            value:
-              _default: "http://attachments-service.attachments.svc.cluster.local:8000"
-
-          - name: BIM_API_V2_URL
-            value:
-              _default: "http://backend-service.bim.svc.cluster.local:8000/"
-          
-          - name: NOTES_URL
-            value:
-              _default: ""
-
-          - name: BIM_V2_HOST
-            value:
-              _default: "http://backend-service.bim.svc.cluster.local:8000/"
-
-          - name: CACHE_CLEANUP_INTERVAL
-            value:
-              _default: "60s"
-
-          - name: CACHE_DEFAULT_EXPIRATION
-            value:
-              _default: "60s"
-
-          - name: DJANGO_HOST
-            value:
-              _default: "http://backend.django.svc.cluster.local:8000"
-
-          - name: DJANGO_ORIGINATOR
-            value:
-              _default: "docs_prod"
-
-          - name: DOCUMENTATION_URL
-            value:
-              _default: "http://documentations-api.documentations.svc.cluster.local:8080/"
-
-          - name: EAV_URL
-            value:
-              _default: "http://eav-service.eav.svc.cluster.local:8000"
-
-          - name: ENABLE_OBSERVABILITY
-            value:
-              _default: "false"
-
-          - name: ENABLE_S3
-            value:
-              _default: "1"
-
-          - name: ENABLE_SSL
-            value:
-              _default: "0"
-
-          - name: ENVIRONMENT
-            value:
-              _default: "prod"
-
-          - name: FLOWS_URL
-            value:
-              _default: "http://backend-service.flows.svc.cluster.local:8000"
-
-          - name: HEIGHT_THUMB_ATTACHMENTS
-            value:
-              _default: "300"
-
-          - name: HEIGHT_THUMB_STATES
-            value:
-              _default: "73"
-
-          - name: HTTP_PORT
-            value:
-              _default: "8080"
-
-          - name: INSPECTIONS_URL
-            value:
-              _default: "http://inspections-service.inspections.svc.cluster.local:80"
-
-          - name: LOG_LEVEL
-            value:
-              _default: "INFO"
-
-          - name: OBSERVABILITY_COLLECTOR_ENDPOINT
-            value:
-              _default: "temp"
-
-          - name: POSTGRES_ADDRESS
-            value:
-              _default: "sarex-vpsql-01.xc.wb.ru"
-
-          - name: POSTGRES_DB
-            value:
-              _default: "documentations_db"
-
-          - name: POSTGRES_POOL_SIZE
-            value:
-              _default: "20"
-
-          - name: TRANSMITTALS_BASE_URL
-            value:
-              _default: "mock"
-
-          - name: POSTGRES_PORT
-            value:
-              _default: "5432"
-
-          - name: READ_WRITE_TIMEOUT_FILE_STREAM
-            value:
-              _default: "6h"
-
-          - name: RELEASES_URL
-            value:
-              _default: "https://gitlab.com"
-
-          - name: REMARKS_URL
-            value:
-              _default: "http://remarks-static-service.remarks.svc.cluster.local:8080/remarks"
-
-          - name: RESOURCES_URL
-            value:
-              _default: "http://iams.iam.svc.cluster.local:8080"
-
-          - name: S3_SERVICE_ACCOUNT
-            value:
-              _default: "/etc/sarex/yc-s3-storage/yc-s3-service-account.json"
-
-          - name: STATES_URL
-            value:
-              _default: "http://workspaces-service.workspaces.svc.cluster.local:8000/"
-
-          - name: SUBSCRIPTIONS_URL
-            value:
-              _default: "http://sarex-subscriptions-service.subscriptions.svc.cluster.local:80"
-
-          - name: SYSTEM_LOG_URL
-            value:
-              _default: "http://api-service.system-log.svc.cluster.local:8000"
-
-          - name: TARGET_URL
-            value:
-              _default: "http://backend.django.svc.cluster.local:8000"
-
-          - name: USE_CACHE_IN_FILE_STREAMER
-            value:
-              _default: "1"
-
-          - name: USE_SUBSCRIPTIONS
-            value:
-              _default: "false"
-
-          - name: WIDTH_THUMB_ATTACHMENTS
-            value:
-              _default: "300"
-
-          - name: WIDTH_THUMB_STATES
-            value:
-              _default: "120"
-
-          - name: WORKFLOWS_IMAGES_VERSION
-            value:
-              _default: "master"
-
-          - name: WORKFLOW_IMAGES_VERSION
-            value:
-              _default: "master"
-
-          - name: WORKFLOW_URL
-            value:
-              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000/"
-
-          - name: WORKSPACE_BUNDLE_VERSION
-            value:
-              _default: "v1"
-
-          - name: WORKSPACE_URL
-            value:
-              _default: "http://workspaces-service.workspaces.svc.cluster.local:8000/"
-
-        secretEnvs:
-          - name: RELEASES_TOKEN
-            secretName:
-              _default: "releases-token"
-            secretKey: "key"
-
-          - name: POSTGRES_USER
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "username"
-
-          - name: POSTGRES_PASSWORD
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "password"
-
-          - name: DJANGO_BASIC_AUTH
-            secretName:
-              _default: "django-auth"
-            secretKey: "key"
-
-          - name: PUBLIC_KEY
-            secretName:
-              _default: "public-key"
-            secretKey: "key"
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/documentations/wb/redis.yaml

@@ -1,88 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: redis
-  namespace: documentations
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      redis:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/redis:latest
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: redis
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 6379
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: true
-
-          name:
-            _default: redis
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 6379
-
-          targetPort:
-            _default: 6379
-
-          portName:
-            _default: tcp
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/documentations/wb/stamp-verification.yaml

@@ -1,90 +0,0 @@
----
-# stamp-verification — отдельное приложение (apps/stamp-verification),
-# в wb развёрнуто в ns documentations, а не в своём собственном неймспейсе.
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: stamp-verification
-  namespace: documentations
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      stamp-verification:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/stamp-verification-frontend:e11a8f90be462fc325ff99c8c35a8a418815c27b
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: stamp-verification
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 8080
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: true
-
-          name:
-            _default: stamp-verification-frontend-service
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 8080
-
-          targetPort:
-            _default: 8080
-
-          portName:
-            _default: http
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/drawings/wb/backend.yaml

@@ -1,120 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: drawings-api
-  namespace: drawings
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      drawings-api:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/drawings-api:015e68e1b2a3dcc13f0b405e1f761b154a825d24
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: drawings-api
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 8080
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: true
-
-          name:
-            _default: drawings-api-service
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 80
-
-          targetPort:
-            _default: 8080
-
-          portName:
-            _default: http
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        envs:
-          - name: POSTGRES_ADDRESS
-            value:
-              _default: "sarex-vpsql-01.xc.wb.ru:5432"
-
-          - name: POSTGRES_DB
-            value:
-              _default: "drawings_db"
-
-          - name: POSTGRES_POOL_SIZE
-            value:
-              _default: "3"
-
-          - name: API_ADDRESS
-            value:
-              _default: "0.0.0.0:8080"
-
-          - name: ENABLE_SSL
-            value:
-              _default: "0"
-
-        secretEnvs:
-          - name: POSTGRES_USER
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "username"
-
-          - name: POSTGRES_PASSWORD
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "password"
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/drawings/wb/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: drawings
-resources:
-  - backend.yaml

apps/eav/base/helmrelease.yaml

@@ -93,7 +93,7 @@ spec:
                 _default: 6
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/eav:prod_0dcebba6
+            _default: cr.yandex/crp3ccidau046kdj8g9q/eav:prod_0fb73247
           pullPolicy:
             _default: IfNotPresent
         service:

apps/eav/wb/backend.yaml

@@ -1,191 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: backend
-  namespace: eav
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      backend:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/eav:prod_0dcebba6
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: backend
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 8000
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: true
-
-          name:
-            _default: eav-service
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 8000
-
-          targetPort:
-            _default: 8000
-
-          portName:
-            _default: http
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        volumes:
-          _default:
-            - name: django-configmap
-              mountPath:
-                _default: /server/config/settings/production.py
-              subPath:
-                _default: production.py
-              readOnly:
-                _default: true
-              configMap:
-                name:
-                  _default: django-configmap
-                items:
-                  - key: production.py
-                    path:
-                      _default: production.py
-
-            - name: kafka-cert-volume
-              mountPath:
-                _default: /usr/local/share/ca-certificates
-              readOnly:
-                _default: true
-              configMap:
-                name:
-                  _default: kafka-cert
-
-        envs:
-          - name: KAFKA_USERNAME
-            value:
-              _default: "sarex"
-
-          - name: KAFKA_SSL_CAFILE
-            value:
-              _default: "/usr/local/share/ca-certificates/kafka.crt"
-
-          - name: KAFKA_HOST
-            value:
-              _default: "wb-stage-kafka-bootstrap.kafka.svc.cluster.local:9093"
-
-          - name: KAFKA_ENABLED
-            value:
-              _default: "False"
-
-          - name: ASSETS_TOPIC
-            value:
-              _default: "sarex"
-
-          - name: DJANGO_SETTINGS_MODULE
-            value:
-              _default: "config.settings.production"
-
-          - name: DJANGO_POSTGRES_HOST
-            value:
-              _default: "sarex-vpsql-01.xc.wb.ru"
-
-          - name: DJANGO_POSTGRES_DATABASE
-            value:
-              _default: "eav_db"
-
-          - name: YC_S3_ENDPOINT_URL
-            value:
-              _default: "http://minio-svc.minio.svc.cluster.local:9000"
-
-          - name: YC_S3_BUCKET_NAME
-            value:
-              _default: "eav"
-
-        secretEnvs:
-          - name: KAFKA_PASSWORD
-            secretName:
-              _default: "kafka-cred"
-            secretKey: "password"
-
-          - name: DJANGO_POSTGRES_USER
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "username"
-
-          - name: DJANGO_POSTGRES_PASSWORD
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "password"
-
-          - name: JWT_PRIVATE_KEY
-            secretName:
-              _default: "backend-secret"
-            secretKey: "ssh_private.key"
-
-          - name: JWT_PUBLIC_KEY
-            secretName:
-              _default: "backend-secret"
-            secretKey: "ssh_public.key"
-
-          - name: YC_S3_ACCESS_KEY_ID
-            secretName:
-              _default: "s3-secret"
-            secretKey: "login"
-
-          - name: YC_S3_SECRET_ACCESS_KEY
-            secretName:
-              _default: "s3-secret"
-            secretKey: "password"
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/eav/wb/django-configmap.yaml

@@ -1,147 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: django-configmap
-  namespace: eav
-data:
-  production.py: |
-    # production.py
-
-    from .base import *
-    from datetime import timedelta
-    import os
-    from django.core.exceptions import ImproperlyConfigured
-
-    INSTALLED_APPS.append("corsheaders")
-    #MIDDLEWARE = ["corsheaders.middleware.CorsMiddleware"] + MIDDLEWARE
-
-    # DEBUG SETTINGS START
-    # ---------------------------------------------------------------------------------------------------------------------
-    DEBUG = True
-    ALLOWED_HOSTS = ['*']
-    # ---------------------------------------------------------------------------------------------------------------------
-    # DEBUG SETTINGS END
-
-    # DATABASE SETTINGS START
-    # ---------------------------------------------------------------------------------------------------------------------
-    DATABASES = {
-        "default": {
-            "ENGINE": "django.db.backends.postgresql",
-            "NAME": os.getenv("DJANGO_POSTGRES_DATABASE"),
-            "USER": os.getenv("DJANGO_POSTGRES_USER"),
-            "PASSWORD": os.getenv("DJANGO_POSTGRES_PASSWORD"),
-            "HOST": os.getenv("DJANGO_POSTGRES_HOST"),
-            "PORT": "5432",
-        }
-    }
-    # ---------------------------------------------------------------------------------------------------------------------
-    # DATABASE SETTINGS END
-
-    # RESPONSE HEADERS START
-    # ---------------------------------------------------------------------------------------------------------------------
-    CORS_ORIGIN_ALLOW_ALL = True
-
-    CORS_ALLOWED_ORIGINS = [
-        "https://srx.wb.ru",
-    ]
-
-    CORS_TRUSTED_ORIGINS = [
-        "https://srx.wb.ru",
-    ]
-
-    CSRF_TRUSTED_ORIGINS = [
-        "https://srx.wb.ru",
-    ]
-
-    CORS_ALLOW_METHODS = (
-        'DELETE',
-        'GET',
-        'OPTIONS',
-        'PATCH',
-        'POST',
-        'PUT',
-    )
-
-    CORS_ALLOW_HEADERS = (
-        'accept',
-        'accept-encoding',
-        'authorization',
-        'content-type',
-        'user-agent',
-        'x-csrftoken',
-        'x-requested-with',
-        'x-token',
-        'Bearer'
-    )
-    # ---------------------------------------------------------------------------------------------------------------------
-    # RESPONSE HEADERS END
-
-    REST_FRAMEWORK = {
-        "DEFAULT_PAGINATION_CLASS": (
-            "rest_framework.pagination.LimitOffsetPagination"
-        ),
-        "DEFAULT_SCHEMA_CLASS": "rest_framework.schemas.coreapi.AutoSchema",
-        "PAGE_SIZE": 10000,
-        "DEFAULT_FILTER_BACKENDS": [
-            "django_filters.rest_framework.DjangoFilterBackend"
-        ],
-        "DEFAULT_AUTHENTICATION_CLASSES": [
-            "core.auth.ZitadelJWTAuthentication",
-            "rest_framework_simplejwt.authentication.JWTAuthentication",
-            "rest_framework.authentication.SessionAuthentication",
-            "rest_framework.authentication.BasicAuthentication",
-        ],
-        "DEFAULT_PERMISSION_CLASSES": [
-            "rest_framework.permissions.AllowAny",
-        ]
-    }
-
-    # JWT SETTINGS START
-    # ---------------------------------------------------------------------------------------------------------------------
-    def get_env_variable(var_name, default=None):
-        try:
-            return os.getenv(var_name, default)
-        except KeyError:
-            error_msg = f"Set the {var_name} environment variable"
-            if default:
-                return default
-            raise ImproperlyConfigured(error_msg)
-
-    SIMPLE_JWT_ISSUER = get_env_variable("SIMPLE_JWT_ISSUER", default="django")
-
-    SIMPLE_JWT = {
-        "ACCESS_TOKEN_LIFETIME": timedelta(minutes=5),
-        "REFRESH_TOKEN_LIFETIME": timedelta(days=1),
-        "ROTATE_REFRESH_TOKENS": False,
-        "UPDATE_LAST_LOGIN": False,
-
-        "ALGORITHM": "RS512",
-        "SIGNING_KEY": get_env_variable("JWT_PRIVATE_KEY").replace("\\\n", "\n"),
-        "VERIFYING_KEY": get_env_variable("JWT_PUBLIC_KEY").replace("\\\n", "\n"),
-        "AUDIENCE": None,
-        "ISSUER": SIMPLE_JWT_ISSUER,
-
-        "AUTH_HEADER_TYPES": ("Bearer",),
-        "AUTH_HEADER_NAME": "HTTP_AUTHORIZATION",
-        "USER_ID_FIELD": "id",
-        "USER_ID_CLAIM": "user_id",
-
-        "AUTH_TOKEN_CLASSES": ("rest_framework_simplejwt.tokens.AccessToken",),
-        "TOKEN_TYPE_CLAIM": "token_type",
-
-        "JTI_CLAIM": "jti",
-
-        "SLIDING_TOKEN_REFRESH_EXP_CLAIM": "refresh_exp",
-        "SLIDING_TOKEN_LIFETIME": timedelta(minutes=5),
-        "SLIDING_TOKEN_REFRESH_LIFETIME": timedelta(days=1),
-    }
-    # ---------------------------------------------------------------------------------------------------------------------
-    # JWT SETTINGS END
-
-    STATIC_ROOT = '/static/'
-    STATIC_URL = '/static/'
-    STATICFILES_STORAGE = 'django.contrib.staticfiles.storage.StaticFilesStorage'
-
-    SESSION_COOKIE_NAME = 'eav-sessionid'
-    CSRF_COOKIE_NAME = 'eav-csrftoken'

apps/eav/wb/kafka-cert-configmap.yaml

@@ -1,38 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: kafka-cert
-  namespace: eav
-data:
-  kafka.crt: |
-    -----BEGIN CERTIFICATE-----
-    MIIFLTCCAxWgAwIBAgIUA5L48eHPMqNFYE5wIgaOmWgG3okwDQYJKoZIhvcNAQEN
-    BQAwLTETMBEGA1UECgwKaW8uc3RyaW16aTEWMBQGA1UEAwwNY2x1c3Rlci1jYSB2
-    MDAeFw0yNTA2MDQxMTMzMTRaFw0yNjA2MDQxMTMzMTRaMC0xEzARBgNVBAoMCmlv
-    LnN0cmltemkxFjAUBgNVBAMMDWNsdXN0ZXItY2EgdjAwggIiMA0GCSqGSIb3DQEB
-    AQUAA4ICDwAwggIKAoICAQDV2NBVwnXISH9i8K4KxSd2AThwgQyRKyeIfcqeYZ4F
-    7FguEUI7uEtoWd4uO8DsIzoMoLYv5L1DfhNYUFWN3XYQd4XVFnwYQYbwspdC1L8G
-    u0T7943gRRRomcNP8n5nycfeZgZgmz9IS8vmxgRh4ao0kcCW49uBQMd706087UAI
-    qaRJTcabTZq1LTeoH9AOAyT/nawKm+1H5VmrMUBjzz9xKVXF0sCrhjYoZoM4x+fY
-    AphtxZDB21ZhEcHBbytEQkEm0QTbUP4xbu95yqY6goYi9S9R1uMgVZ9DoJVwyqLm
-    /3ZGPjd9VmdBPO/zE/Bj890DjyKS7AXo9d+Iyv4M2QD1jA+5j4JyHzk7Lroz+HTg
-    mwVpcVGafBWIC4qFt7C3UYt6IV64/MA2v9gxTIdJvOBZxKUiMl7f65jKNEntF6is
-    86QCkjhvt34AThEoGx8SPjVr3sOBuneqcybeSYLyEWFg9Z1mWfMLHlA/Fp/Y2wpM
-    w1ZXj6uAa/UNUAIfkaLTOKHHaCCVD2G3Vkm94NHOJmDj6ze8P0J0H+Ub6ULD7hHr
-    8obOSk9OvxoxVzE+UW7DyEL6YD8MBVUQKJIQVgZmpT4akWyz8bNhFRzgTnKAhwNN
-    ATrGmjfX/wj7tCpy/PoJjEiu54sXW5xplBIz/ZgYHrPkyrbhQxsRozgQ+UIMIIbJ
-    /wIDAQABo0UwQzAdBgNVHQ4EFgQUkU4HKndgWxhcXMAe5XBc4OJwSgcwEgYDVR0T
-    AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQENBQADggIB
-    AFLi5QLawZollou3+m5kYcBe5F8xKG5NlgNmKyIREnwD2AP4xrr2tNFbmP2hpEl4
-    bWJJ84IHlKjpYxFLboWzgtW/JvdxcEh0K/x8/7cOD3Kk9d/LR9muj57mFYSQGlbo
-    g0+lHNuLam8xGcnGVV5VdfcjFz72/q92ndTlJmz+v6OneTJvIypKoBmNKF25alz9
-    pR2sTwoG0Pcwm30u/uS6pOewQ4sTiniOcc1MFYF7tl/Zz9Mqza8Rer0B5nm8lE/J
-    Yo9UaEXyVLM8Y5kSOkxMlOK+8/UMeY/lcQYpd5tYVpvarnoPCjmUjt4iVw26ZsAH
-    y4/vNW+wX+Uauarik1jHL/SauAjS3FbJoH06BBnji7J/Rud2DtSd+vVZrIBLJkaH
-    +Xg/roD3xKx0XmhLJmPvxGrkyehbhkbJkPKCHa9P56rnev3MYjyy+SV7Vp8Dq+HF
-    Wkswl3QUPWx9reuvF2KMyt04Tw94UAxCUGkX5qg7Dq5d0Fj/AcIrFdLTCV8eG/UI
-    1kKRxmZ2/ALINBOlfJOVVovKBlWpPACs8iy6XreOXtoQfzoG2F9Vo3Jmzjpqsmz0
-    9Ao4s2vcz3UuDtBhpwGp4N3zroyst/kQjtZirj4cS7fu75tB5N5mQ/tTwg0Tiw+Y
-    XIdxeE73V5DAf4Dd5V1VdCbA6oQv5qJYvinYydyx4x3V
-    -----END CERTIFICATE-----

apps/eav/wb/kustomization.yaml

@@ -1,8 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: eav
-resources:
-  - django-configmap.yaml
-  - kafka-cert-configmap.yaml
-  - backend.yaml

apps/faas/wb/backend.yaml

@@ -1,145 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: export-reviews
-  namespace: faas
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      export-reviews:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/export-reviews:prod_c4cae4ee
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: export-reviews
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 8000
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: true
-
-          name:
-            _default: export-reviews-service
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 8000
-
-          targetPort:
-            _default: 8000
-
-          portName:
-            _default: http
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        envs:
-          - name: BASE_HOST
-            value:
-              _default: "https://srx.wb.ru"
-
-          - name: DJANGO_HOST
-            value:
-              _default: "https://srx.wb.ru"
-
-          - name: REVIEWS_HOST
-            value:
-              _default: "https://srx.wb.ru/flows"
-
-          - name: GATEWAY_HOST
-            value:
-              _default: "https://srx.wb.ru/gateway"
-
-          - name: DOCUMENTATIONS_HOST
-            value:
-              _default: "https://srx.wb.ru/documentations"
-
-          - name: EAV_HOST
-            value:
-              _default: "http://eav-service.eav.svc.cluster.local:8000"
-
-          - name: TRANSMITTALS_INTERNAL_HOST
-            value:
-              _default: "http://transmittal-service.transmittal.svc.cluster.local:80/internal/v1"
-
-          - name: DJANGO_TIMEOUT
-            value:
-              _default: "180"
-
-          - name: REVIEWS_TIMEOUT
-            value:
-              _default: "180"
-
-          - name: GATEWAY_TIMEOUT
-            value:
-              _default: "60"
-
-          - name: DOCUMENTATIONS_TIMEOUT
-            value:
-              _default: "60"
-
-          - name: EAV_TIMEOUT
-            value:
-              _default: "30"
-
-          - name: TRANSMITTALS_TIMEOUT
-            value:
-              _default: "30"
-
-          - name: TIMEOUT
-            value:
-              _default: "180"
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/flows/wb/authentication-configmap.yaml

@@ -1,93 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: authentication
-  namespace: flows
-data:
-  authentication.py: |
-    import httpx
-
-    from fastapi import Request, status
-    from itsdangerous import URLSafeTimedSerializer, BadData as BadDataError
-    from sqladmin.authentication import AuthenticationBackend
-
-    from flow.config import settings
-
-
-    class AdminAuthentication(AuthenticationBackend):
-        def get_serializer(self) -> URLSafeTimedSerializer:
-            return URLSafeTimedSerializer(
-                secret_key=settings.admin_panel.secret_key,
-            )
-
-        async def login(self, request: Request) -> bool:
-            form = await request.form()
-            username, password = form["username"], form["password"]
-            token_payload = {
-                    'is_django_user': False,
-                    'user_id': None,
-                }
-            # получаем данные о юзере
-            if True:
-                #print("OK"*30)
-                # client: httpx.AsyncClient = settings.django.get_async_session(token=settings.django.token)
-                # async with client as session:
-                #     auth_response = await session.post(url='/login/', json={
-                #         'username': username,
-                #         'password': password,
-                #     }, follow_redirects=False)
-                #     print("*"*30, auth_response.status_code ,settings.django.host, username, password,"*"*30)
-                #     if auth_response.status_code != status.HTTP_200_OK:
-                #         return False
-
-                    # django_response = await session.get(url='/client/settings/')
-                    # print("$"*30, django_response.status_code, "$"*30)
-                    # if django_response.status_code != status.HTTP_200_OK:
-                    #     return False
-                    if username == "68Lvh2PsHd5y" and password == "Hnzvh2PsHd5yI1v":
-                        #user = django_response.json()
-                        has_access = True
-                        if not has_access:
-                            return False
-
-                        user_id = 2
-
-                        token_payload = {
-                            'is_django_user': True,
-                            'user_id': user_id,
-                        }
-            else:
-                token_payload = {
-                    'is_django_user': False,
-                    'user_id': None,
-                }
-
-            token = self.get_serializer().dumps(token_payload)
-
-            request.session.update({"token": token})
-            return True
-
-        async def logout(self, request: Request) -> bool:
-            request.session.clear()
-            return True
-
-        async def authenticate(self, request: Request) -> bool:
-            token = request.session.get("token")
-
-            if not token:
-                return False
-
-            try:
-                payload = self.get_serializer().loads(token, max_age=settings.admin_panel.token_max_age)
-            except (BadDataError, KeyError):
-                return False
-
-            is_django_user = payload.get('is_django_user')
-            if settings.django.use != is_django_user:
-                return False
-
-            return True
-
-
-    authentication_backend = AdminAuthentication(secret_key=settings.admin_panel.secret_key)

apps/flows/wb/backend.yaml

@@ -1,357 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: backend
-  namespace: flows
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      backend:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend:production_a7dc8216
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: backend
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 8000
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: true
-
-          name:
-            _default: backend-service
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 8000
-
-          targetPort:
-            _default: 8000
-
-          portName:
-            _default: http
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        volumes:
-          _default:
-            - name: authentication
-              mountPath:
-                _default: /opt/src/flow/admin/authentication.py
-              subPath:
-                _default: authentication.py
-              readOnly:
-                _default: true
-              configMap:
-                name:
-                  _default: authentication
-                items:
-                  - key: authentication.py
-                    path:
-                      _default: authentication.py
-
-            - name: kafka-configmap
-              mountPath:
-                _default: /opt/src/flow/kafka.py
-              subPath:
-                _default: kafka.py
-              readOnly:
-                _default: true
-              configMap:
-                name:
-                  _default: kafka-configmap
-                items:
-                  - key: kafka.py
-                    path:
-                      _default: kafka.py
-
-        envs:
-          - name: KAFKA_HOST
-            value:
-              _default: "wb-prod-kafka-bootstrap.kafka.svc.cluster.local:9093"
-
-          - name: KAFKA_SSL_CERT
-            value:
-              _default: |
-                -----BEGIN CERTIFICATE-----
-                MIIFLTCCAxWgAwIBAgIUYDZPxGRsr7IiqHEmfd07QTQlOKYwDQYJKoZIhvcNAQEN
-                BQAwLTETMBEGA1UECgwKaW8uc3RyaW16aTEWMBQGA1UEAwwNY2x1c3Rlci1jYSB2
-                MDAeFw0yNTEyMTYxNDM0NTVaFw0yNjEyMTYxNDM0NTVaMC0xEzARBgNVBAoMCmlv
-                LnN0cmltemkxFjAUBgNVBAMMDWNsdXN0ZXItY2EgdjAwggIiMA0GCSqGSIb3DQEB
-                AQUAA4ICDwAwggIKAoICAQCfzDZhEzw2pbU5Xpu8OzD+3iQG+DVjU8PQWWQEF27h
-                yjohDkUr3zCZtW7xMKWKUNxBgrKsfe4TDOQN8cij3cS9sy0So+UhMeF7Bq9PU1Yd
-                bmTRq8q1PiuNUkiCGJ5wrb3+NZvVxZLJUIFgiealsRw80MgMWWSzy0I35T2Edn/a
-                DU4jhlgQxyzQ621+oGP0n28gCjmm6pCq2tkj/Z8WTdu1gOWyRdK02a2uE2Ts2nLa
-                Di32GaZrIbIuD/WUd6Ek66uCeJvh2CT7s+SqgtMbtT7gibUuPQ3hk1VGQsjy22l3
-                hUNpLu86nrwbuf21mY55KnLOcaVq1ag1TpIIKfZAL/KWFCGZ6H6kwEIbCAL0Hei7
-                cJ2Wm2/qlzKUeU869M7YybZAfXl/t6XT4QgFgje+42N980vy5A4GhWi1Z7lPqqOe
-                jPGBstkRZybKz1sTk87+oJx82iQU/ozVmzjSEK1SoYRNbvug8PNpxmPoPnJ2flgG
-                t2q2+2ZQP3f1aAHVcZ3U5+hWlRmKPXzjrJv7gnhuvqJl7OwB50y+yWiVfZ9xrYl2
-                EpX+yHuFFK+9NnB5taUK8Fz+hQaLU8J4q7P0bRqkoI+LdcEErjuDT/eI2d5+Ql8K
-                /JkV823hX2WNB9bdaQ24BelVUbsxGpR7ms6KWrM11kHnbzUlEM+AxZES6F7Qbr55
-                TwIDAQABo0UwQzAdBgNVHQ4EFgQUM7hshx7e9TFEN82Pf446aBrJUA4wEgYDVR0T
-                AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQENBQADggIB
-                AFNHFGPDxY966fz0dxDFFSfeo47y7XQZMK9xAwH73cQoSeqx+IMxzgM8nfJQ9XMN
-                PeLwVRZ7pvRee2ZhUPglBSTHnW2rvfmLBOO9xyKZxRsCkoFxuHH9xfM7bFWb96R6
-                fGrOdEZDB3yj00T+tkubwqt+/dUhQUj8juwyPs55WMb/0BIbapaoQ6QOP13CaXDV
-                ZmAfsEEIBkNxfq7GTr/z0Rq0B4+9FxAf3Jrsmi/dYoFD/prHsvBDkYw1daoFyp5C
-                tbctvB9wtphnCCynekt8UBvpVKHUU/xaUa09TQTToXjBbV1SZeIOHNG0MNbWa4sz
-                AL/cpXdq1EAxiTeAVT9XhCwhe/xJvFZIWuFLmW3J+ZxrOUCKieCYpTqBY2tBkkDY
-                //egic787yTR6zxqQNSzvNU5LhzrN7lu+KHGM06T35+HvpzgPPiRCzsxO62p63op
-                mq04K31yYZgLiqeAj5W+rioRGJNn4TXJpH9KIrzmGM7lVWLYWMAKeZU4r1lDUdcu
-                7jsBH8BRJWJeVK3xVw2HB3lk7Xn0WrR92adeYQ3f0vKbMIAVUnSJ3yCKJ4NMFSki
-                j78nx2mi/G0RhUPGZ9hhLXQKj9BtbpEnwpbGWtf0ShtVOxD/HKLCr7koBtW9TMPS
-                9K0sJhE5VjsQLkDDu9p3GdRcuLNA/oa7xFvRFtqGFsLj
-                -----END CERTIFICATE-----
-
-          - name: LOG_LEVEL
-            value:
-              _default: "DEBUG"
-
-          - name: BASE_HOST
-            value:
-              _default: "https://srx.wb.ru"
-
-          - name: CELERY_QUEUE
-            value:
-              _default: "flow"
-
-          - name: EAV_HOST
-            value:
-              _default: "http://eav-service.eav.svc.cluster.local:8000"
-
-          - name: DJANGO_HOST
-            value:
-              _default: "http://backend.django.svc.cluster.local:8000/api"
-
-          - name: PLANNING_HOST
-            value:
-              _default: "http://backend-service.pm.svc.cluster.local:8000/api/pm/msp"
-
-          - name: PLANNING_USE
-            value:
-              _default: "True"
-
-          - name: DOCUMENTATION_HOST
-            value:
-              _default: "http://documentations-api.documentations.svc.cluster.local:8080/internal/v1"
-
-          - name: DOCUMENTATION_EXTERNAL_HOST
-            value:
-              _default: "http://documentations-api.documentations.svc.cluster.local:8080/api/v1"
-
-          - name: ENABLE_ANALYTICS
-            value:
-              _default: "1"
-
-          - name: ENABLE_CELERY
-            value:
-              _default: "1"
-
-          - name: ENABLE_MAILGUN
-            value:
-              _default: "0"
-
-          - name: ENABLE_METRICS
-            value:
-              _default: "0"
-
-          - name: FROM_EMAIL
-            value:
-              _default: "sarex@rwb.ru"
-
-          - name: GATEWAY_URL
-            value:
-              _default: "http://pdm-api.documentations.svc.cluster.local:8080"
-
-          - name: PG_HOST
-            value:
-              _default: "sarex-vpsql-01.xc.wb.ru"
-
-          - name: PG_PORT
-            value:
-              _default: "5432"
-
-          - name: RABBITMQ_HOST
-            value:
-              _default: "rabbitmq.rabbitmq.svc.cluster.local"
-
-          - name: RABBITMQ_PORT
-            value:
-              _default: "5672"
-
-          - name: RESOURCE_URL
-            value:
-              _default: "http://iams.iam.svc.cluster.local:8080"
-
-          - name: SERVICE_HOST
-            value:
-              _default: "https://srx.wb.ru/flows/api/v1"
-
-          - name: SMTP_HOST
-            value:
-              _default: "mail.rwb.ru"
-
-          - name: DOCUMENTATION_PG_PORT
-            value:
-              _default: "5432"
-
-          - name: PROXY_PATH_PREFIX
-            value:
-              _default: "/flows"
-
-          - name: DOCUMENTATION_PG_DATABASE
-            value:
-              _default: "documentations_db"
-
-          - name: DOCUMENTATION_PG_HOST
-            value:
-              _default: "sarex-vpsql-01.xc.wb.ru"
-
-          - name: CHECKLIST_HOST
-            value:
-              _default: "http://checklists-backend-service.checklists.svc.cluster.local:80"
-
-          - name: SMTP_PORT
-            value:
-              _default: "465"
-
-          - name: SYNC_RESOURCE_ID
-            value:
-              _default: "1"
-
-          - name: TIMEOUT
-            value:
-              _default: "120"
-
-          - name: WORKFLOWS_HOST
-            value:
-              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000/api/v1"
-
-          - name: WORKFLOWS_TIMEOUT
-            value:
-              _default: "60"
-
-          - name: DOCUMENTATION_TIMEOUT
-            value:
-              _default: "60"
-
-        secretEnvs:
-          - name: ADMIN_PANEL_SECRET_KEY
-            secretName:
-              _default: "admin-secret"
-            secretKey: "key"
-
-          - name: JWT_PUBLIC_KEY
-            secretName:
-              _default: "jwt-secret"
-            secretKey: "public_key"
-
-          - name: DOCUMENTATION_PG_USERNAME
-            secretName:
-              _default: "postgres-secret-documentations"
-            secretKey: "username"
-
-          - name: DOCUMENTATION_PG_PASSWORD
-            secretName:
-              _default: "postgres-secret-documentations"
-            secretKey: "password"
-
-          - name: DJANGO_TOKEN
-            secretName:
-              _default: "django-secret"
-            secretKey: "token"
-
-          - name: PG_DB
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "database"
-
-          - name: PG_LOGIN
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "username"
-
-          - name: PG_PASSWORD
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "password"
-
-          - name: RABBITMQ_USERNAME
-            secretName:
-              _default: "rabbitmq-secret"
-            secretKey: "username"
-
-          - name: RABBITMQ_PASSWORD
-            secretName:
-              _default: "rabbitmq-secret"
-            secretKey: "password"
-
-          - name: RABBITMQ_VHOST
-            secretName:
-              _default: "rabbitmq-secret"
-            secretKey: "vhost"
-
-          - name: KAFKA_USERNAME
-            secretName:
-              _default: "kafka-secret"
-            secretKey: "username"
-
-          - name: KAFKA_PASSWORD
-            secretName:
-              _default: "kafka-secret"
-            secretKey: "password"
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/flows/wb/celery.yaml

@@ -1,373 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: celery
-  namespace: flows
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      celery:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-backend_worker:production_a7dc8216
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: celery
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 8000
-
-          command:
-            _default: ["celery", "-A", "src.worker", "worker", "-l", "INFO", "-E", "--concurrency=1", "-Q", "flow"]
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: false
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        volumes:
-          _default:
-            - name: kafka-configmap
-              mountPath:
-                _default: /opt/src/flow/kafka.py
-              subPath:
-                _default: kafka.py
-              readOnly:
-                _default: true
-              configMap:
-                name:
-                  _default: kafka-configmap
-                items:
-                  - key: kafka.py
-                    path:
-                      _default: kafka.py
-
-        envs:
-          - name: KAFKA_HOST
-            value:
-              _default: "wb-prod-kafka-bootstrap.kafka.svc.cluster.local:9093"
-
-          - name: KAFKA_SSL_CERT
-            value:
-              _default: |
-                -----BEGIN CERTIFICATE-----
-                MIIFLTCCAxWgAwIBAgIUYDZPxGRsr7IiqHEmfd07QTQlOKYwDQYJKoZIhvcNAQEN
-                BQAwLTETMBEGA1UECgwKaW8uc3RyaW16aTEWMBQGA1UEAwwNY2x1c3Rlci1jYSB2
-                MDAeFw0yNTEyMTYxNDM0NTVaFw0yNjEyMTYxNDM0NTVaMC0xEzARBgNVBAoMCmlv
-                LnN0cmltemkxFjAUBgNVBAMMDWNsdXN0ZXItY2EgdjAwggIiMA0GCSqGSIb3DQEB
-                AQUAA4ICDwAwggIKAoICAQCfzDZhEzw2pbU5Xpu8OzD+3iQG+DVjU8PQWWQEF27h
-                yjohDkUr3zCZtW7xMKWKUNxBgrKsfe4TDOQN8cij3cS9sy0So+UhMeF7Bq9PU1Yd
-                bmTRq8q1PiuNUkiCGJ5wrb3+NZvVxZLJUIFgiealsRw80MgMWWSzy0I35T2Edn/a
-                DU4jhlgQxyzQ621+oGP0n28gCjmm6pCq2tkj/Z8WTdu1gOWyRdK02a2uE2Ts2nLa
-                Di32GaZrIbIuD/WUd6Ek66uCeJvh2CT7s+SqgtMbtT7gibUuPQ3hk1VGQsjy22l3
-                hUNpLu86nrwbuf21mY55KnLOcaVq1ag1TpIIKfZAL/KWFCGZ6H6kwEIbCAL0Hei7
-                cJ2Wm2/qlzKUeU869M7YybZAfXl/t6XT4QgFgje+42N980vy5A4GhWi1Z7lPqqOe
-                jPGBstkRZybKz1sTk87+oJx82iQU/ozVmzjSEK1SoYRNbvug8PNpxmPoPnJ2flgG
-                t2q2+2ZQP3f1aAHVcZ3U5+hWlRmKPXzjrJv7gnhuvqJl7OwB50y+yWiVfZ9xrYl2
-                EpX+yHuFFK+9NnB5taUK8Fz+hQaLU8J4q7P0bRqkoI+LdcEErjuDT/eI2d5+Ql8K
-                /JkV823hX2WNB9bdaQ24BelVUbsxGpR7ms6KWrM11kHnbzUlEM+AxZES6F7Qbr55
-                TwIDAQABo0UwQzAdBgNVHQ4EFgQUM7hshx7e9TFEN82Pf446aBrJUA4wEgYDVR0T
-                AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQENBQADggIB
-                AFNHFGPDxY966fz0dxDFFSfeo47y7XQZMK9xAwH73cQoSeqx+IMxzgM8nfJQ9XMN
-                PeLwVRZ7pvRee2ZhUPglBSTHnW2rvfmLBOO9xyKZxRsCkoFxuHH9xfM7bFWb96R6
-                fGrOdEZDB3yj00T+tkubwqt+/dUhQUj8juwyPs55WMb/0BIbapaoQ6QOP13CaXDV
-                ZmAfsEEIBkNxfq7GTr/z0Rq0B4+9FxAf3Jrsmi/dYoFD/prHsvBDkYw1daoFyp5C
-                tbctvB9wtphnCCynekt8UBvpVKHUU/xaUa09TQTToXjBbV1SZeIOHNG0MNbWa4sz
-                AL/cpXdq1EAxiTeAVT9XhCwhe/xJvFZIWuFLmW3J+ZxrOUCKieCYpTqBY2tBkkDY
-                //egic787yTR6zxqQNSzvNU5LhzrN7lu+KHGM06T35+HvpzgPPiRCzsxO62p63op
-                mq04K31yYZgLiqeAj5W+rioRGJNn4TXJpH9KIrzmGM7lVWLYWMAKeZU4r1lDUdcu
-                7jsBH8BRJWJeVK3xVw2HB3lk7Xn0WrR92adeYQ3f0vKbMIAVUnSJ3yCKJ4NMFSki
-                j78nx2mi/G0RhUPGZ9hhLXQKj9BtbpEnwpbGWtf0ShtVOxD/HKLCr7koBtW9TMPS
-                9K0sJhE5VjsQLkDDu9p3GdRcuLNA/oa7xFvRFtqGFsLj
-                -----END CERTIFICATE-----
-
-          - name: LOG_LEVEL
-            value:
-              _default: "DEBUG"
-
-          - name: FLOWS_HOST
-            value:
-              _default: "http://backend-service.flows.svc.cluster.local:8000"
-
-          - name: DOCUMENTATION_PG_PORT
-            value:
-              _default: "5432"
-
-          - name: DOCUMENTATION_PG_DATABASE
-            value:
-              _default: "documentations_db"
-
-          - name: DOCUMENTATION_PG_HOST
-            value:
-              _default: "sarex-vpsql-01.xc.wb.ru"
-
-          - name: BASE_HOST
-            value:
-              _default: "https://lk.srx.wb.ru:30443"
-
-          - name: CELERY_QUEUE
-            value:
-              _default: "flow"
-
-          - name: RESOURCES_HOST
-            value:
-              _default: "http://resources-service.resources.svc.cluster.local:8000/"
-
-          - name: DJANGO_HOST
-            value:
-              _default: "http://backend.django.svc.cluster.local:8000/api"
-
-          - name: DOCUMENTATION_HOST
-            value:
-              _default: "http://documentations-api.documentations.svc.cluster.local:8080/internal/v1"
-
-          - name: DOCUMENTATION_EXTERNAL_HOST
-            value:
-              _default: "http://documentations-api.documentations.svc.cluster.local:8080/api/v1"
-
-          - name: ENABLE_ANALYTICS
-            value:
-              _default: "1"
-
-          - name: FLOWS_DB_HOST
-            value:
-              _default: "sarex-vpsql-01.xc.wb.ru"
-
-          - name: FLOWS_DB_PORT
-            value:
-              _default: "5432"
-
-          - name: ISSUES_DB_PORT
-            value:
-              _default: "5432"
-
-          - name: ISSUES_DB_HOST
-            value:
-              _default: "sarex-vpsql-01.xc.wb.ru"
-
-          - name: ENABLE_CELERY
-            value:
-              _default: "1"
-
-          - name: ENABLE_MAILGUN
-            value:
-              _default: "0"
-
-          - name: ENABLE_METRICS
-            value:
-              _default: "0"
-
-          - name: FROM_EMAIL
-            value:
-              _default: "wb@wb.ru"
-
-          - name: GATEWAY_URL
-            value:
-              _default: "http://pdm-api.documentations.svc.cluster.local:8080"
-
-          - name: PG_HOST
-            value:
-              _default: "sarex-vpsql-01.xc.wb.ru"
-
-          - name: PG_PORT
-            value:
-              _default: "5432"
-
-          - name: RABBITMQ_HOST
-            value:
-              _default: "rabbitmq.rabbitmq.svc.cluster.local"
-
-          - name: RABBITMQ_PORT
-            value:
-              _default: "5672"
-
-          - name: DJANGO_BASE_HOST
-            value:
-              _default: "https://srx.wb.ru"
-
-          - name: RESOURCE_URL
-            value:
-              _default: "http://resources-service.resources.svc.cluster.local:8000"
-
-          - name: SERVICE_HOST
-            value:
-              _default: "https://lk.srx.wb.ru:30443/flows/api/v1"
-
-          - name: SMTP_HOST
-            value:
-              _default: "smtp-relay.wb.com"
-
-          - name: SMTP_PORT
-            value:
-              _default: "587"
-
-          - name: SYNC_RESOURCE_ID
-            value:
-              _default: "1"
-
-          - name: TIMEOUT
-            value:
-              _default: "120"
-
-          - name: WORKFLOWS_HOST
-            value:
-              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000/api/v1"
-
-          - name: WORKFLOWS_TIMEOUT
-            value:
-              _default: "60"
-
-          - name: DOCUMENTATION_TIMEOUT
-            value:
-              _default: "60"
-
-        secretEnvs:
-          - name: ADMIN_PANEL_SECRET_KEY
-            secretName:
-              _default: "admin-secret"
-            secretKey: "key"
-
-          - name: JWT_PUBLIC_KEY
-            secretName:
-              _default: "jwt-secret"
-            secretKey: "public_key"
-
-          - name: DOCUMENTATION_PG_USERNAME
-            secretName:
-              _default: "postgres-secret-documentations"
-            secretKey: "username"
-
-          - name: DOCUMENTATION_PG_PASSWORD
-            secretName:
-              _default: "postgres-secret-documentations"
-            secretKey: "password"
-
-          - name: FLOWS_DB_DB
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "database"
-
-          - name: FLOWS_DB_USERNAME
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "username"
-
-          - name: FLOWS_DB_PASSWORD
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "password"
-
-          - name: ISSUES_DB_DB
-            secretName:
-              _default: "postgres-secret-issues"
-            secretKey: "database"
-
-          - name: ISSUES_DB_USERNAME
-            secretName:
-              _default: "postgres-secret-issues"
-            secretKey: "username"
-
-          - name: ISSUES_DB_PASSWORD
-            secretName:
-              _default: "postgres-secret-issues"
-            secretKey: "password"
-
-          - name: DJANGO_AUTH
-            secretName:
-              _default: "django-secret"
-            secretKey: "token"
-
-          - name: DJANGO_TOKEN
-            secretName:
-              _default: "django-secret"
-            secretKey: "token"
-
-          - name: PG_DB
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "database"
-
-          - name: PG_LOGIN
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "username"
-
-          - name: PG_PASSWORD
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "password"
-
-          - name: RABBITMQ_USERNAME
-            secretName:
-              _default: "rabbitmq-secret"
-            secretKey: "username"
-
-          - name: RABBITMQ_PASSWORD
-            secretName:
-              _default: "rabbitmq-secret"
-            secretKey: "password"
-
-          - name: RABBITMQ_VHOST
-            secretName:
-              _default: "rabbitmq-secret"
-            secretKey: "vhost"
-
-          - name: KAFKA_USERNAME
-            secretName:
-              _default: "kafka-secret"
-            secretKey: "username"
-
-          - name: KAFKA_PASSWORD
-            secretName:
-              _default: "kafka-secret"
-            secretKey: "password"
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/flows/wb/frontend.yaml

@@ -1,95 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: frontend
-  namespace: flows
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      frontend:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/flows-frontend:contour_5b2bd144
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: frontend
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 80
-
-          resources:
-            requests:
-              cpu:
-                _default: 100m
-              memory:
-                _default: 100Mi
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: true
-
-          name:
-            _default: frontend-service
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 80
-
-          targetPort:
-            _default: 80
-
-          portName:
-            _default: http
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/flows/wb/kafka-configmap.yaml

@@ -1,67 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: kafka-configmap
-  namespace: flows
-data:
-  kafka.py: |
-    import ssl
-    from functools import partial
-
-    import anyio
-    from faststream.kafka import KafkaBroker
-    from faststream.security import BaseSecurity
-
-    from flow.config import logger, settings
-    from flow.models.events import BaseEvent
-
-
-    def _build_broker() -> KafkaBroker:
-        ssl_context = ssl.create_default_context()
-
-        ssl_context.check_hostname = False
-        ssl_context.verify_mode = ssl.CERT_NONE
-
-        if settings.kafka.ssl_cert:
-            ssl_context.load_verify_locations(cadata=settings.kafka.ssl_cert)
-
-        security = BaseSecurity(
-            ssl_context=ssl_context,
-            use_ssl=True,
-        )
-
-        return KafkaBroker(
-            bootstrap_servers=[settings.kafka.host],
-            security=security,
-        )
-
-
-    broker = _build_broker()
-
-
-    async def _publish(event: BaseEvent, key: str) -> None:
-        await broker.publish(
-            message=event,
-            topic=event.metadata.event_type,
-            key=key.encode(),
-        )
-
-
-    def publish_event(event: BaseEvent, key: str) -> None:
-        if not settings.enable_events:
-            return
-
-        try:
-            anyio.from_thread.run(partial(_publish, event, key))
-        except Exception:
-            logger.exception(
-                "Failed to publish kafka event %s",
-                event.metadata.event_type,
-            )
-
-
-    __all__ = [
-        "broker",
-        "publish_event",
-    ]

apps/flows/wb/kustomization.yaml

@@ -1,10 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: flows
-resources:
-  - authentication-configmap.yaml
-  - kafka-configmap.yaml
-  - backend.yaml
-  - celery.yaml
-  - frontend.yaml

apps/iam/wb/backend-s3.yaml

@@ -1,87 +0,0 @@
----
-# В base S3_ENDPOINT_URL смотрит на storage.yandexcloud.net (Яндекс.Облако) —
-# в wb используется собственный self-hosted MinIO.
-# ZITADEL_HOST в base (sarex-login.uralmine.com) не трогаем: это общий
-# платформенный SSO для iam, не переопределяется ни в одном клиентском контуре.
-#
-# TODO: для iam в vault wb (1.yaml) ещё не заведён infrastructure.minio.apps.iam
-# (нет реального client.endpoint/bucket, в отличие от attachments/django/...) —
-# 10.49.10.90:9000 здесь взят по аналогии с остальными приложениями wb.
-# Проверить/поправить, когда в vault появится бакет для iam.
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: iam-backend
-  namespace: iam
-spec:
-  values:
-    services:
-      backend:
-        envs:
-          - name: ENVIRONMENT
-            value:
-              _default: "prod"
-
-          - name: LOG_LEVEL
-            value:
-              _default: "debug"
-
-          - name: AUTH_ENABLED
-            value:
-              _default: "true"
-
-          - name: HTTP_PORT
-            value:
-              _default: "8080"
-
-          - name: HTTP_READ_BUFFER_SIZE
-            value:
-              _default: "131072"
-
-          - name: DB_MIGRATIONS_PATH
-            value:
-              _default: "migrations"
-
-          - name: ZITADEL_ENABLED
-            value:
-              _default: "true"
-
-          - name: ZITADEL_HOST
-            value:
-              _default: "https://sarex-login.uralmine.com"
-
-          - name: ZITADEL_ORG_RULES_FILE
-            value:
-              _default: "config/zitadel/org-rules-prod.json"
-
-          - name: S3_ENABLED
-            value:
-              _default: "true"
-
-          - name: S3_ENDPOINT_URL
-            value:
-              _default: "http://10.49.10.90:9000"
-
-          - name: S3_BUCKET_NAME
-            value:
-              _default: "sarex-media-storage"
-
-          - name: S3_REGION
-            value:
-              _default: "ru-central1"
-
-          - name: S3_PRESIGN_EXPIRES
-            value:
-              _default: "1h"
-
-          - name: KAFKA_ENABLED
-            value:
-              _default: "false"
-
-          - name: KAFKA_SSL_CAFILE
-            value:
-              _default: "/etc/ca-certificates/Yandex/ca-cert"
-
-          - name: KAFKA_TOPIC_LEGACY_AMS_SYNC
-            value:
-              _default: "ams-sync"

apps/inspections/wb/backend.yaml

@@ -1,234 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: inspections-backend
-  namespace: inspections
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      api:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/sarex-inspections:production_1a33f6f4
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: inspections-backend
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 8000
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: true
-
-          name:
-            _default: sarex-inspections-service
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 80
-
-          targetPort:
-            _default: 8000
-
-          portName:
-            _default: http
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        envs:
-          - name: DEBUG
-            value:
-              _default: "false"
-
-          - name: SERVICE_URL
-            value:
-              _default: "https://srx.wb.ru"
-
-          - name: HTTP_APP_HOST
-            value:
-              _default: "0.0.0.0"
-
-          - name: HTTP_APP_PORT
-            value:
-              _default: "8000"
-
-          - name: HTTP_APP_ROOT_PATH
-            value:
-              _default: "/inspections"
-
-          - name: HTTP_APP_WORKERS
-            value:
-              _default: "3"
-
-          - name: HTTP_APP_ADMIN_ENABLE
-            value:
-              _default: "true"
-
-          - name: KAFKA_SSL_CAFILE
-            value:
-              _default: "/usr/local/share/ca-certificates/Yandex/YandexInternalRootCA.crt"
-
-          - name: KAFKA_EAV_ASSETS_TOPIC
-            value:
-              _default: "assets_broadcast"
-
-          - name: JWT_AUTH_ENABLE
-            value:
-              _default: "true"
-
-          - name: NOTIFICATIONS_ENABLE
-            value:
-              _default: "true"
-
-          - name: NOTIFICATIONS_EMAIL_FROM
-            value:
-              _default: "hello@sarex.io"
-
-          - name: SAREX_BACKEND_URL
-            value:
-              _default: "https://srx.wb.ru"
-
-          - name: SAREX_BACKEND_TIMEOUT
-            value:
-              _default: "30"
-
-          - name: EAV_URL
-            value:
-              _default: "http://eav-service.eav"
-
-          - name: EAV_TIMEOUT
-            value:
-              _default: "30"
-
-          # В дампе кластера значение было http://workflows-service.processing-prod —
-          # тот же неймспейс, что в вопросе про processing/workflow: реальный
-          # ns у processing в wb — workflow.
-          - name: WORKFLOWS_URL
-            value:
-              _default: "http://workflows-service.workflow"
-
-          - name: WORKFLOWS_TIMEOUT
-            value:
-              _default: "30"
-
-          - name: WORKFLOWS_EMAIL_DOCKER_IMAGE
-            value:
-              _default: "cr.yandex/crp3ccidau046kdj8g9q/notification:email"
-
-          - name: MOBILE_APP_CURRENT_VERSION
-            value:
-              _default: "1.0.0"
-
-          - name: MOBILE_APP_RECOMMENDED_VERSION
-            value:
-              _default: "1.0.0"
-
-          - name: MOBILE_APP_REQUIRED_VERSION
-            value:
-              _default: "1.0.0"
-
-          - name: MAILER_URL
-            value:
-              _default: "http://mailer-service.mailer:8000"
-
-          - name: MAILER_TIMEOUT
-            value:
-              _default: "30"
-
-        secretEnvs:
-          - name: DATABASE_USER
-            secretName:
-              _default: "pg-secret"
-            secretKey: "username"
-
-          - name: DATABASE_PORT
-            secretName:
-              _default: "pg-secret"
-            secretKey: "port"
-
-          - name: DATABASE_NAME
-            secretName:
-              _default: "pg-secret"
-            secretKey: "database"
-
-          - name: DATABASE_HOST
-            secretName:
-              _default: "pg-secret"
-            secretKey: "host"
-
-          - name: DATABASE_PASSWORD
-            secretName:
-              _default: "pg-secret"
-            secretKey: "password"
-
-          - name: KAFKA_HOST
-            secretName:
-              _default: "kafka-secret"
-            secretKey: "host"
-
-          - name: KAFKA_USERNAME
-            secretName:
-              _default: "kafka-secret"
-            secretKey: "username"
-
-          - name: KAFKA_PASSWORD
-            secretName:
-              _default: "kafka-secret"
-            secretKey: "password"
-
-          - name: SAREX_BACKEND_AUTH
-            secretName:
-              _default: "sarex-backend-auth-secret"
-            secretKey: "key"
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/inspections/wb/kustomization.yaml

@@ -1,6 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: inspections
-resources:
-  - backend.yaml

apps/issues/base/backend.yaml

@@ -42,7 +42,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_bbb9d29a
+            _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_2dc38909
           pullPolicy:
             _default: IfNotPresent
 

apps/issues/base/celery.yaml

@@ -42,7 +42,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_bbb9d29a
+            _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_2dc38909
           pullPolicy:
             _default: IfNotPresent
 

apps/issues/base/frontend.yaml

@@ -36,7 +36,7 @@ spec:
 
         image:
           name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/contour_issues-frontend:b56b9da1
+            _default: cr.yandex/crp3ccidau046kdj8g9q/contour_issues-frontend:716a2b73
           pullPolicy:
             _default: IfNotPresent
 

apps/issues/brusnika-stage/backend.yaml

@@ -176,6 +176,10 @@ spec:
           - name: API_ADDRESS
             value:
               _default: "8000"
+
+          - name: RABBITMQ_HOSTNAME
+            value:
+              _default: "rabbitmq-service:5672"
         secretEnvs:
           - name: YC_S3_ACCESS_KEY_ID
             secretName:
@@ -227,24 +231,19 @@ spec:
               _default: "postgres-secret"
             secretKey: "database"
 
-          - name: RABBITMQ_HOSTNAME
-            secretName:
-              _default: "rabbitmq"
-            secretKey: "hostname"
-
           - name: RABBITMQ_VHOST
             secretName:
-              _default: "rabbitmq"
+              _default: "rabbitmq-secret"
             secretKey: "vhost"
 
           - name: RABBITMQ_USERNAME
             secretName:
-              _default: "rabbitmq"
+              _default: "rabbitmq-secret"
             secretKey: "username"
 
           - name: RABBITMQ_PASSWORD
             secretName:
-              _default: "rabbitmq"
+              _default: "rabbitmq-secret"
             secretKey: "password"
 
           - name: JWT_PRIVATE_KEY

apps/issues/brusnika-stage/celery.yaml

@@ -187,6 +187,10 @@ spec:
           - name: API_ADDRESS
             value:
               _default: "8000"
+
+          - name: RABBITMQ_HOSTNAME
+            value:
+              _default: "rabbitmq-service:5672"
         secretEnvs:
           - name: YC_S3_ACCESS_KEY_ID
             secretName:
@@ -238,24 +242,19 @@ spec:
               _default: "postgres-secret"
             secretKey: "database"
 
-          - name: RABBITMQ_HOSTNAME
-            secretName:
-              _default: "rabbitmq"
-            secretKey: "hostname"
-
           - name: RABBITMQ_VHOST
             secretName:
-              _default: "rabbitmq"
+              _default: "rabbitmq-secret"
             secretKey: "vhost"
 
           - name: RABBITMQ_USERNAME
             secretName:
-              _default: "rabbitmq"
+              _default: "rabbitmq-secret"
             secretKey: "username"
 
           - name: RABBITMQ_PASSWORD
             secretName:
-              _default: "rabbitmq"
+              _default: "rabbitmq-secret"
             secretKey: "password"
 
           - name: JWT_PRIVATE_KEY

apps/issues/wb/app-configmap.yaml

@@ -1,55 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: app
-  namespace: issues
-data:
-  app.py: |
-    import ssl
-    from django.conf import settings
-    from faststream import FastStream
-    from faststream.kafka import KafkaBroker
-    from faststream.security import BaseSecurity
-
-
-    def get_broker() -> KafkaBroker:
-        ssl_context = ssl.create_default_context(
-            cafile=settings.KAFKA_SSL_CAFILE,
-        )
-
-        # Сертификат передаем, но hostname не проверяем
-        ssl_context.check_hostname = False
-
-        # Для самоподписанного сертификата
-        ssl_context.verify_mode = ssl.CERT_NONE
-
-        security = BaseSecurity(
-            ssl_context=ssl_context,
-            use_ssl=True,
-        )
-
-        broker = KafkaBroker(
-            bootstrap_servers=[settings.KAFKA_HOST],
-            security=security,
-        )
-
-        return broker
-
-
-    def get_consumer_broker() -> KafkaBroker:
-        broker = get_broker()
-
-        from kafka_app.consumers import eav_router
-
-        broker.include_router(eav_router)
-
-        return broker
-
-
-    def configure_app() -> FastStream:
-        broker = get_consumer_broker()
-
-        app = FastStream(broker)
-
-        return app

apps/issues/wb/celery.yaml

@@ -1,281 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: celery
-  namespace: issues
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      celery:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_bbb9d29a
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: celery
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 8000
-
-          command:
-            _default: ["celery", "-A", "config", "worker", "-l", "info", "-E"]
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: false
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        volumes:
-          _default:
-            - name: kafka-cert-volume
-              mountPath:
-                _default: /usr/local/share/ca-certificates
-              readOnly:
-                _default: true
-              configMap:
-                name:
-                  _default: kafka-cert
-
-            - name: app
-              mountPath:
-                _default: /src/kafka_app/app.py
-              subPath:
-                _default: app.py
-              readOnly:
-                _default: true
-              configMap:
-                name:
-                  _default: app
-                items:
-                  - key: app.py
-                    path:
-                      _default: app.py
-
-            - name: uwsgi-configmap
-              mountPath:
-                _default: /opt/server/uwsgi.ini
-              subPath:
-                _default: uwsgi.ini
-              readOnly:
-                _default: true
-              configMap:
-                name:
-                  _default: uwsgi-configmap
-                items:
-                  - key: uwsgi.ini
-                    path:
-                      _default: uwsgi.ini
-
-            - name: production-configmap
-              mountPath:
-                _default: /src/config/settings/production.py
-              subPath:
-                _default: production.py
-              readOnly:
-                _default: true
-              configMap:
-                name:
-                  _default: production-configmap
-                items:
-                  - key: production.py
-                    path:
-                      _default: production.py
-
-        envs:
-          - name: ENVIRONMENT
-            value:
-              _default: "production"
-
-          - name: AERO_PUBLIC_HOST
-            value:
-              _default: "https://srx.wb.ru"
-
-          - name: AERO_HOST
-            value:
-              _default: "https://srx.wb.ru"
-
-          - name: BASE_AERO_URL
-            value:
-              _default: "https://srx.wb.ru"
-
-          - name: BASE_AUTH_URL
-            value:
-              _default: "https://srx.wb.ru"
-
-          - name: WORKFLOWS_HOST
-            value:
-              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000"
-
-          - name: WORKFLOWS_URL
-            value:
-              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000"
-
-          - name: RESOURCES_API_HOST
-            value:
-              _default: "http://resources-service.resources.svc.cluster.local:8000"
-
-          - name: EAV_HOST
-            value:
-              _default: "http://eav-service.eav.svc.cluster.local:8000"
-
-          - name: USE_NOTIFICATIONS
-            value:
-              _default: "True"
-
-          - name: ENABLE_MAILGUN
-            value:
-              _default: "False"
-
-          - name: SAREX_API
-            value:
-              _default: "https://srx.wb.ru"
-
-          - name: DOCUMENTATIONS_URL
-            value:
-              _default: "http://documentations-api.documentations.svc.cluster.local:8080"
-
-          - name: DJANGO_SETTINGS_MODULE
-            value:
-              _default: "config.settings.production"
-
-          - name: DATABASE_HOST
-            value:
-              _default: "sarex-vpsql-01.xc.wb.ru"
-
-          - name: DATABASE_PORT
-            value:
-              _default: "5432"
-
-          - name: API_ADDRESS
-            value:
-              _default: "8000"
-
-          - name: RABBITMQ_HOSTNAME
-            value:
-              _default: "rabbitmq.rabbitmq.svc.cluster.local:5672"
-
-        secretEnvs:
-          - name: YC_S3_ACCESS_KEY_ID
-            secretName:
-              _default: "yc-s3-secret"
-            secretKey: "key_id"
-
-          - name: YC_S3_SECRET_ACCESS_KEY
-            secretName:
-              _default: "yc-s3-secret"
-            secretKey: "access_key"
-
-          - name: YC_S3_BUCKET_NAME
-            secretName:
-              _default: "yc-s3-secret"
-            secretKey: "storage_bucket_name"
-
-          - name: YC_S3_ENDPOINT_URL
-            secretName:
-              _default: "yc-s3-secret"
-            secretKey: "endpoint_url"
-
-          - name: DJANGO_BASIC_AUTH
-            secretName:
-              _default: "django-auth"
-            secretKey: "key"
-
-          - name: SAREX_USERNAME
-            secretName:
-              _default: "sarex-auth"
-            secretKey: "username"
-
-          - name: SAREX_PASSWORD
-            secretName:
-              _default: "sarex-auth"
-            secretKey: "password"
-
-          - name: DATABASE_USER
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "username"
-
-          - name: DATABASE_PASSWORD
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "password"
-
-          - name: DATABASE_NAME
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "database"
-
-          - name: RABBITMQ_VHOST
-            secretName:
-              _default: "rabbitmq-secret"
-            secretKey: "vhost"
-
-          - name: RABBITMQ_USERNAME
-            secretName:
-              _default: "rabbitmq-secret"
-            secretKey: "username"
-
-          - name: RABBITMQ_PASSWORD
-            secretName:
-              _default: "rabbitmq-secret"
-            secretKey: "password"
-
-          - name: JWT_PRIVATE_KEY
-            secretName:
-              _default: "backend-secret"
-            secretKey: "ssh_private.key"
-
-          - name: JWT_PUBLIC_KEY
-            secretName:
-              _default: "backend-secret"
-            secretKey: "ssh_public.key"
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/issues/wb/issues.yaml

@@ -1,270 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: issues
-  namespace: issues
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      issues:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/issues:production_bbb9d29a
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: issues
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 8000
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: true
-
-          name:
-            _default: issues-service
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 80
-
-          targetPort:
-            _default: 8000
-
-          portName:
-            _default: http
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        volumes:
-          _default:
-            - name: kafka-cert-volume
-              mountPath:
-                _default: /usr/local/share/ca-certificates
-              readOnly:
-                _default: true
-              configMap:
-                name:
-                  _default: kafka-cert
-
-            - name: uwsgi-configmap
-              mountPath:
-                _default: /opt/server/uwsgi.ini
-              subPath:
-                _default: uwsgi.ini
-              readOnly:
-                _default: true
-              configMap:
-                name:
-                  _default: uwsgi-configmap
-                items:
-                  - key: uwsgi.ini
-                    path:
-                      _default: uwsgi.ini
-
-            - name: production-configmap
-              mountPath:
-                _default: /src/config/settings/production.py
-              subPath:
-                _default: production.py
-              readOnly:
-                _default: true
-              configMap:
-                name:
-                  _default: production-configmap
-                items:
-                  - key: production.py
-                    path:
-                      _default: production.py
-
-        envs:
-          - name: ENVIRONMENT
-            value:
-              _default: "production"
-
-          - name: AERO_PUBLIC_HOST
-            value:
-              _default: "https://srx.wb.ru"
-
-          - name: AERO_HOST
-            value:
-              _default: "https://srx.wb.ru"
-
-          - name: BASE_AERO_URL
-            value:
-              _default: "https://srx.wb.ru"
-
-          - name: BASE_AUTH_URL
-            value:
-              _default: "http://backend.django.svc.cluster.local:8000"
-
-          - name: WORKFLOWS_HOST
-            value:
-              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000"
-
-          - name: WORKFLOWS_URL
-            value:
-              _default: "http://workflows-api-service.workflow.svc.cluster.local:8000"
-
-          - name: RESOURCES_API_HOST
-            value:
-              _default: "http://resources-service.resources.svc.cluster.local:8000"
-
-          - name: EAV_HOST
-            value:
-              _default: "http://eav-service.eav.svc.cluster.local:8000"
-
-          - name: SAREX_API
-            value:
-              _default: "https://srx.wb.ru"
-
-          - name: DOCUMENTATIONS_URL
-            value:
-              _default: "http://documentations-api.documentations.svc.cluster.local:8080"
-
-          - name: DJANGO_SETTINGS_MODULE
-            value:
-              _default: "config.settings.production"
-
-          - name: DATABASE_HOST
-            value:
-              _default: "sarex-vpsql-01.xc.wb.ru"
-
-          - name: DATABASE_PORT
-            value:
-              _default: "5432"
-
-          - name: API_ADDRESS
-            value:
-              _default: "8000"
-
-          - name: RABBITMQ_HOSTNAME
-            value:
-              _default: "rabbitmq.rabbitmq.svc.cluster.local:5672"
-
-        secretEnvs:
-          - name: YC_S3_ACCESS_KEY_ID
-            secretName:
-              _default: "yc-s3-secret"
-            secretKey: "key_id"
-
-          - name: YC_S3_SECRET_ACCESS_KEY
-            secretName:
-              _default: "yc-s3-secret"
-            secretKey: "access_key"
-
-          - name: YC_S3_BUCKET_NAME
-            secretName:
-              _default: "yc-s3-secret"
-            secretKey: "storage_bucket_name"
-
-          - name: YC_S3_ENDPOINT_URL
-            secretName:
-              _default: "yc-s3-secret"
-            secretKey: "endpoint_url"
-
-          - name: DJANGO_BASIC_AUTH
-            secretName:
-              _default: "django-auth"
-            secretKey: "key"
-
-          - name: SAREX_USERNAME
-            secretName:
-              _default: "sarex-auth"
-            secretKey: "username"
-
-          - name: SAREX_PASSWORD
-            secretName:
-              _default: "sarex-auth"
-            secretKey: "password"
-
-          - name: DATABASE_USER
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "username"
-
-          - name: DATABASE_PASSWORD
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "password"
-
-          - name: DATABASE_NAME
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "database"
-
-          - name: RABBITMQ_VHOST
-            secretName:
-              _default: "rabbitmq-secret"
-            secretKey: "vhost"
-
-          - name: RABBITMQ_USERNAME
-            secretName:
-              _default: "rabbitmq-secret"
-            secretKey: "username"
-
-          - name: RABBITMQ_PASSWORD
-            secretName:
-              _default: "rabbitmq-secret"
-            secretKey: "password"
-
-          - name: JWT_PRIVATE_KEY
-            secretName:
-              _default: "backend-secret"
-            secretKey: "ssh_private.key"
-
-          - name: JWT_PUBLIC_KEY
-            secretName:
-              _default: "backend-secret"
-            secretKey: "ssh_public.key"
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/issues/wb/kafka-cert-configmap.yaml

@@ -1,38 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: kafka-cert
-  namespace: issues
-data:
-  kafka.crt: |
-    -----BEGIN CERTIFICATE-----
-    MIIFLTCCAxWgAwIBAgIUA5L48eHPMqNFYE5wIgaOmWgG3okwDQYJKoZIhvcNAQEN
-    BQAwLTETMBEGA1UECgwKaW8uc3RyaW16aTEWMBQGA1UEAwwNY2x1c3Rlci1jYSB2
-    MDAeFw0yNTA2MDQxMTMzMTRaFw0yNjA2MDQxMTMzMTRaMC0xEzARBgNVBAoMCmlv
-    LnN0cmltemkxFjAUBgNVBAMMDWNsdXN0ZXItY2EgdjAwggIiMA0GCSqGSIb3DQEB
-    AQUAA4ICDwAwggIKAoICAQDV2NBVwnXISH9i8K4KxSd2AThwgQyRKyeIfcqeYZ4F
-    7FguEUI7uEtoWd4uO8DsIzoMoLYv5L1DfhNYUFWN3XYQd4XVFnwYQYbwspdC1L8G
-    u0T7943gRRRomcNP8n5nycfeZgZgmz9IS8vmxgRh4ao0kcCW49uBQMd706087UAI
-    qaRJTcabTZq1LTeoH9AOAyT/nawKm+1H5VmrMUBjzz9xKVXF0sCrhjYoZoM4x+fY
-    AphtxZDB21ZhEcHBbytEQkEm0QTbUP4xbu95yqY6goYi9S9R1uMgVZ9DoJVwyqLm
-    /3ZGPjd9VmdBPO/zE/Bj890DjyKS7AXo9d+Iyv4M2QD1jA+5j4JyHzk7Lroz+HTg
-    mwVpcVGafBWIC4qFt7C3UYt6IV64/MA2v9gxTIdJvOBZxKUiMl7f65jKNEntF6is
-    86QCkjhvt34AThEoGx8SPjVr3sOBuneqcybeSYLyEWFg9Z1mWfMLHlA/Fp/Y2wpM
-    w1ZXj6uAa/UNUAIfkaLTOKHHaCCVD2G3Vkm94NHOJmDj6ze8P0J0H+Ub6ULD7hHr
-    8obOSk9OvxoxVzE+UW7DyEL6YD8MBVUQKJIQVgZmpT4akWyz8bNhFRzgTnKAhwNN
-    ATrGmjfX/wj7tCpy/PoJjEiu54sXW5xplBIz/ZgYHrPkyrbhQxsRozgQ+UIMIIbJ
-    /wIDAQABo0UwQzAdBgNVHQ4EFgQUkU4HKndgWxhcXMAe5XBc4OJwSgcwEgYDVR0T
-    AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQENBQADggIB
-    AFLi5QLawZollou3+m5kYcBe5F8xKG5NlgNmKyIREnwD2AP4xrr2tNFbmP2hpEl4
-    bWJJ84IHlKjpYxFLboWzgtW/JvdxcEh0K/x8/7cOD3Kk9d/LR9muj57mFYSQGlbo
-    g0+lHNuLam8xGcnGVV5VdfcjFz72/q92ndTlJmz+v6OneTJvIypKoBmNKF25alz9
-    pR2sTwoG0Pcwm30u/uS6pOewQ4sTiniOcc1MFYF7tl/Zz9Mqza8Rer0B5nm8lE/J
-    Yo9UaEXyVLM8Y5kSOkxMlOK+8/UMeY/lcQYpd5tYVpvarnoPCjmUjt4iVw26ZsAH
-    y4/vNW+wX+Uauarik1jHL/SauAjS3FbJoH06BBnji7J/Rud2DtSd+vVZrIBLJkaH
-    +Xg/roD3xKx0XmhLJmPvxGrkyehbhkbJkPKCHa9P56rnev3MYjyy+SV7Vp8Dq+HF
-    Wkswl3QUPWx9reuvF2KMyt04Tw94UAxCUGkX5qg7Dq5d0Fj/AcIrFdLTCV8eG/UI
-    1kKRxmZ2/ALINBOlfJOVVovKBlWpPACs8iy6XreOXtoQfzoG2F9Vo3Jmzjpqsmz0
-    9Ao4s2vcz3UuDtBhpwGp4N3zroyst/kQjtZirj4cS7fu75tB5N5mQ/tTwg0Tiw+Y
-    XIdxeE73V5DAf4Dd5V1VdCbA6oQv5qJYvinYydyx4x3V
-    -----END CERTIFICATE-----

apps/issues/wb/kustomization.yaml

@@ -1,14 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: issues
-resources:
-  - app-configmap.yaml
-  - production-configmap.yaml
-  - uwsgi-configmap.yaml
-  - kafka-cert-configmap.yaml
-  - issues.yaml
-  - celery.yaml
-  - redis.yaml
-  - static.yaml
-  - remarks-static.yaml

apps/issues/wb/production-configmap.yaml

@@ -1,143 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: production-configmap
-  namespace: issues
-data:
-  production.py: |
-    from datetime import timedelta
-    import os
-    from .base import *
-
-    # DEBUG SETTINGS START
-    # -----------------------------------------------------------------------------
-    DEBUG = True
-    # -----------------------------------------------------------------------------
-
-    TEST_MODE = False
-    #USE_NOTIFICATIONS = False
-    AWS_S3_VERIFY=False
-
-    # SECRETS SETTINGS START
-    # -----------------------------------------------------------------------------
-    SECRET_KEY = "FromToMuchLoveOfLiving"  # Delete after Test
-    # -----------------------------------------------------------------------------
-
-    DJANGO_TOKEN="aGFnZW4wMTM6emVhbG90MDk2"
-
-    # ALLOWED HOSTS START
-    # -----------------------------------------------------------------------------
-    ALLOWED_HOSTS = ["*"]
-    # -----------------------------------------------------------------------------
-
-    # APPS SETTINGS START
-    # -----------------------------------------------------------------------------
-    # INSTALLED_APPS += [
-    #     "django_extensions",
-    # ]
-    # -----------------------------------------------------------------------------
-
-    # DEBUG SETTINGS START
-    # -----------------------------------------------------------------------------
-    DEBUG = True
-    # -----------------------------------------------------------------------------
-
-    REVIEW_HOST='http://backend-service.flows.svc.cluster.local:8000'
-    # -----------------------------------------------------------------------------
-    # EXTERNAL SERVICES END
-
-    WORKFLOWS_HOST = "http://workflows-api-service.workflow.svc.cluster.local:8000"
-    WORKFLOWS_URL = "http://workflows-api-service.workflow.svc.cluster.local:8000"
-    DOCUMENTATIONS_URL = "http://documentations-api.documentations.svc.cluster.local:8080"
-    RESOURCES_API_HOST = os.getenv("RESOURCES_API_HOST", default="http://resources-service.resources.svc.cluster:8000")
-    KAFKA_HOST = "wb-prod-kafka-bootstrap.kafka.svc.cluster.local:9093"
-    KAFKA_USERNAME = "sarex"
-    KAFKA_PASSWORD = "nK36sasvSfoItJnXQ4qxav2OUWIPX5ZC"
-    KAFKA_SSL_CAFILE = os.getenv("KAFKA_SSL_CAFILE", "/usr/local/share/ca-certificates/kafka.crt")
-    KAFKA_EAV_ASSETS_TOPIC = os.getenv("KAFKA_EAV_ASSETS_TOPIC", "sarex")
-    KAFKA_ISSUES_TOPIC = os.getenv("KAFKA_ISSUES_TOPIC", "sarex-issues")
-
-
-    USE_ASYNC_FUNCTIONS = True
-    #USE_NOTIFICATIONS = False
-
-    # JWT SETTINGS START
-    # ---------------------------------------------------------------------------------------------------------------------
-    SIMPLE_JWT_ISSUER = os.getenv("SIMPLE_JWT_ISSUER", default="default_issuer")
-
-    SIMPLE_JWT = {
-        "ACCESS_TOKEN_LIFETIME": timedelta(minutes=5),
-        "REFRESH_TOKEN_LIFETIME": timedelta(days=1),
-        "ROTATE_REFRESH_TOKENS": False,
-        "UPDATE_LAST_LOGIN": False,
-
-        "ALGORITHM": "RS512",
-        "SIGNING_KEY": os.getenv("JWT_PRIVATE_KEY", default="").replace("\\n", "\n"),
-        "VERIFYING_KEY": os.getenv("JWT_PUBLIC_KEY").replace("\\n", "\n"),
-        "AUDIENCE": None,
-        "ISSUER": SIMPLE_JWT_ISSUER,
-
-        "AUTH_HEADER_TYPES": ("Bearer",),
-        "AUTH_HEADER_NAME": "HTTP_AUTHORIZATION",
-        "USER_ID_FIELD": "id",
-        "USER_ID_CLAIM": "user_id",
-
-        "AUTH_TOKEN_CLASSES": ("rest_framework_simplejwt.tokens.AccessToken",),
-        "TOKEN_TYPE_CLAIM": "token_type",
-
-        "JTI_CLAIM": "jti",
-
-        "SLIDING_TOKEN_REFRESH_EXP_CLAIM": "refresh_exp",
-        "SLIDING_TOKEN_LIFETIME": timedelta(minutes=5),
-        "SLIDING_TOKEN_REFRESH_LIFETIME": timedelta(days=1),
-    }
-    # ---------------------------------------------------------------------------------------------------------------------
-
-    CORS_ALLOWED_ORIGINS = [
-        "https://lk.srx.wb.ru:30443",
-    ]
-
-    CORS_TRUSTED_ORIGINS = [
-        "https://lk.srx.wb.ru:30443",
-    ]
-
-    CSRF_TRUSTED_ORIGINS = [
-        "https://lk.srx.wb.ru:30443",
-    ]
-
-    CORS_ALLOW_ALL_ORIGINS = True
-    ENABLE_MAILGUN=False
-    SMTP_PORT=465
-    SMTP_HOST="mail.rwb.ru"
-    EMAIL_FROM="sarex@rwb.ru"
-
-    CORS_ALLOW_METHODS = [
-        "DELETE",
-        "GET",
-        "OPTIONS",
-        "PATCH",
-        "POST",
-        "PUT",
-    ]
-
-    SAREX_API = "https://srx.wb.ru"
-
-    AERO_PUBLIC_HOST = os.getenv("AERO_PUBLIC_HOST", default=SAREX_API)
-
-    BASE_AERO_URL = "http://backend.django.svc.cluster.local:8000"
-
-    ENVIRONMENT = "production"
-
-    SESSION_COOKIE_NAME = "issues-sessionid"
-    CSRF_COOKIE_NAME = "issues-csrftoken"
-    STATIC_URL = "/static/"
-    STORAGES = {
-        'default': {
-            'BACKEND': "storages.backends.s3boto3.S3Boto3Storage",
-        },
-        'staticfiles': {
-            # Leave whatever setting you already have here, e.g.:
-            'BACKEND': "storages.backends.s3boto3.S3Boto3Storage",
-        }
-    }

apps/issues/wb/redis.yaml

@@ -1,88 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: redis
-  namespace: issues
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      redis:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/redis:latest
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: redis
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 6379
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: true
-
-          name:
-            _default: redis
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 6379
-
-          targetPort:
-            _default: 6379
-
-          portName:
-            _default: tcp
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/issues/wb/remarks-static.yaml

@@ -1,90 +0,0 @@
----
-# remarks-static — компонент приложения remarks (apps/remarks), в wb
-# развёрнут в ns issues, а не в своём собственном неймспейсе.
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: remarks-static
-  namespace: issues
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      remarks-static:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/remarks-frontend:wb_2c0adf31
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: remarks-static
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 8080
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: true
-
-          name:
-            _default: remarks-static
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 80
-
-          targetPort:
-            _default: 8080
-
-          portName:
-            _default: tcp
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/issues/wb/static.yaml

@@ -1,88 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: static
-  namespace: issues
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      static:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/contour_issues-frontend:b56b9da1
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: static
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 80
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: true
-
-          name:
-            _default: static-service
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 80
-
-          targetPort:
-            _default: 80
-
-          portName:
-            _default: http
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/issues/wb/uwsgi-configmap.yaml

@@ -1,23 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: uwsgi-configmap
-  namespace: issues
-data:
-  uwsgi.ini: |-
-    [uwsgi]
-    plugins-dir = /usr/lib/uwsgi/plugins
-
-    chdir           = /src
-    module          = config.wsgi:application
-    master          = true
-    processes       = 4
-    http            = 0.0.0.0:8000
-    chmod-socket    = 666
-    vacuum          = true
-    harakiri        = 6000
-    buffer-size     = 32768
-
-    static-map = /static=/opt/src/static/
-    static-map = /media=/opt/src/media/

apps/measurements/aero/kustomization.yaml

@@ -0,0 +1,41 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: measurements
+resources:
+  - ../base
+
+patches:
+  - target: {kind: HelmRelease, name: measurements}
+    patch: |
+      # Имя сервиса приводим к measurements-service, как в brusnika-*.
+      #
+      # В base сервис называется measurements-svc, а django ходит на
+      #   MEASUREMENTS_HOST=http://measurements-service.measurements.svc.cluster.local:8000/api
+      # (apps/django/base/backend.yaml). Переименовать сервис дешевле, чем
+      # патчить переменную в двух релизах django (backend и celery), и заодно
+      # совпадает с тем, как это сделано в остальных кластерах.
+      - op: replace
+        path: /spec/values/services/backend/service/name/_default
+        value: measurements-service
+
+      # S3: бакет берём из секрета, а не из шаблона.
+      #
+      # В base имя бакета ЗАШИТО прямо в vault-шаблоне — "buckets":["measurements"].
+      # Из-за этого measurements складывал файлы в собственный бакет, тогда как
+      # медиахранилище контура одно и называется sarex-media-storage: туда пишет
+      # django (S3_BUCKET) и оттуда же раздаёт s3-proxy на маршруте /media/.
+      # Разные бакеты означали, что ссылка на файл измерения, отданная через
+      # django, вела бы в пустоту.
+      #
+      # Endpoint в base уже приезжает из секрета (.Data.data.client.endpoint) —
+      # достраиваем до той же схемы и бакет, чтобы имя задавалось в ОДНОМ месте
+      # (vault_app_secrets в aero/roles/sarex_stack/defaults/main.yml), а не
+      # дублировалось в манифесте. Заменить можно только аннотацию целиком:
+      # значение зашито внутри шаблона, через values его не перекрыть.
+      - op: replace
+        path: /spec/values/services/backend/podAnnotations/_default/vault.hashicorp.com~1agent-inject-template-measurements-s3
+        value: |-
+          {{- with secret "secrets/data/minio/apps/measurements" -}}
+          S3_JSON_SETTINGS='{"host":"{{ index .Data.data.client "endpoint" }}","login":"{{ index .Data.data "access_key" }}","password":"{{ index .Data.data "secret_key" }}","verify":false,"buckets":["{{ index .Data.data "bucket" }}"]}'
+          {{- end -}}

apps/message-hub/wb/kafka-cert-configmap.yaml

@@ -1,38 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: kafka-cert
-  namespace: message-hub
-data:
-  kafka.crt: |
-    -----BEGIN CERTIFICATE-----
-    MIIFLTCCAxWgAwIBAgIUYDZPxGRsr7IiqHEmfd07QTQlOKYwDQYJKoZIhvcNAQEN
-    BQAwLTETMBEGA1UECgwKaW8uc3RyaW16aTEWMBQGA1UEAwwNY2x1c3Rlci1jYSB2
-    MDAeFw0yNTEyMTYxNDM0NTVaFw0yNjEyMTYxNDM0NTVaMC0xEzARBgNVBAoMCmlv
-    LnN0cmltemkxFjAUBgNVBAMMDWNsdXN0ZXItY2EgdjAwggIiMA0GCSqGSIb3DQEB
-    AQUAA4ICDwAwggIKAoICAQCfzDZhEzw2pbU5Xpu8OzD+3iQG+DVjU8PQWWQEF27h
-    yjohDkUr3zCZtW7xMKWKUNxBgrKsfe4TDOQN8cij3cS9sy0So+UhMeF7Bq9PU1Yd
-    bmTRq8q1PiuNUkiCGJ5wrb3+NZvVxZLJUIFgiealsRw80MgMWWSzy0I35T2Edn/a
-    DU4jhlgQxyzQ621+oGP0n28gCjmm6pCq2tkj/Z8WTdu1gOWyRdK02a2uE2Ts2nLa
-    Di32GaZrIbIuD/WUd6Ek66uCeJvh2CT7s+SqgtMbtT7gibUuPQ3hk1VGQsjy22l3
-    hUNpLu86nrwbuf21mY55KnLOcaVq1ag1TpIIKfZAL/KWFCGZ6H6kwEIbCAL0Hei7
-    cJ2Wm2/qlzKUeU869M7YybZAfXl/t6XT4QgFgje+42N980vy5A4GhWi1Z7lPqqOe
-    jPGBstkRZybKz1sTk87+oJx82iQU/ozVmzjSEK1SoYRNbvug8PNpxmPoPnJ2flgG
-    t2q2+2ZQP3f1aAHVcZ3U5+hWlRmKPXzjrJv7gnhuvqJl7OwB50y+yWiVfZ9xrYl2
-    EpX+yHuFFK+9NnB5taUK8Fz+hQaLU8J4q7P0bRqkoI+LdcEErjuDT/eI2d5+Ql8K
-    /JkV823hX2WNB9bdaQ24BelVUbsxGpR7ms6KWrM11kHnbzUlEM+AxZES6F7Qbr55
-    TwIDAQABo0UwQzAdBgNVHQ4EFgQUM7hshx7e9TFEN82Pf446aBrJUA4wEgYDVR0T
-    AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQENBQADggIB
-    AFNHFGPDxY966fz0dxDFFSfeo47y7XQZMK9xAwH73cQoSeqx+IMxzgM8nfJQ9XMN
-    PeLwVRZ7pvRee2ZhUPglBSTHnW2rvfmLBOO9xyKZxRsCkoFxuHH9xfM7bFWb96R6
-    fGrOdEZDB3yj00T+tkubwqt+/dUhQUj8juwyPs55WMb/0BIbapaoQ6QOP13CaXDV
-    ZmAfsEEIBkNxfq7GTr/z0Rq0B4+9FxAf3Jrsmi/dYoFD/prHsvBDkYw1daoFyp5C
-    tbctvB9wtphnCCynekt8UBvpVKHUU/xaUa09TQTToXjBbV1SZeIOHNG0MNbWa4sz
-    AL/cpXdq1EAxiTeAVT9XhCwhe/xJvFZIWuFLmW3J+ZxrOUCKieCYpTqBY2tBkkDY
-    //egic787yTR6zxqQNSzvNU5LhzrN7lu+KHGM06T35+HvpzgPPiRCzsxO62p63op
-    mq04K31yYZgLiqeAj5W+rioRGJNn4TXJpH9KIrzmGM7lVWLYWMAKeZU4r1lDUdcu
-    7jsBH8BRJWJeVK3xVw2HB3lk7Xn0WrR92adeYQ3f0vKbMIAVUnSJ3yCKJ4NMFSki
-    j78nx2mi/G0RhUPGZ9hhLXQKj9BtbpEnwpbGWtf0ShtVOxD/HKLCr7koBtW9TMPS
-    9K0sJhE5VjsQLkDDu9p3GdRcuLNA/oa7xFvRFtqGFsLj
-    -----END CERTIFICATE-----

apps/message-hub/wb/kustomization.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: message-hub
-resources:
-  - kafka-cert-configmap.yaml
-  - message-hub.yaml

apps/message-hub/wb/message-hub.yaml

@@ -1,209 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: message-hub
-  namespace: message-hub
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      message-hub:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/message-hub:production_e8010fe4
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: message-hub-message-hub
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 8000
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: true
-
-          name:
-            _default: message-hub-message-hub
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 8000
-
-          targetPort:
-            _default: 8000
-
-          portName:
-            _default: http
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        volumes:
-          _default:
-            - name: kafka-cert-volume
-              mountPath:
-                _default: /usr/local/share/ca-certificates
-              readOnly:
-                _default: true
-              configMap:
-                name:
-                  _default: kafka-cert
-
-        envs:
-          - name: WORKER_TIMEOUT
-            value:
-              _default: "60"
-
-          - name: PYTHONPATH
-            value:
-              _default: "src"
-
-          - name: SETTINGS_MAX_RETRIES
-            value:
-              _default: "1"
-
-          - name: SETTINGS_TOPICS
-            value:
-              _default: '{"planning": "pm", "assets": "assets_broadcast", "project_entity": "issues_broadcast"}'
-
-          - name: SETTINGS_PDF_CONVERTER_HOST
-            value:
-              _default: "http://export-project-service.django.svc.cluster.local:8000"
-
-          - name: SAREX_BASE_HOST
-            value:
-              _default: "http://backend-service.pm.svc.cluster.local:8000"
-
-          - name: DB_HOST
-            value:
-              _default: "sarex-vpsql-01.xc.wb.ru"
-
-          - name: DB_PORT
-            value:
-              _default: "5432"
-
-          - name: DB_DATABASE
-            value:
-              _default: "pm_db"
-
-          - name: CACHE_HOST
-            value:
-              _default: "redis.pm.svc.cluster.local"
-
-          - name: CACHE_PORT
-            value:
-              _default: "6379"
-
-          - name: CACHE_SSL
-            value:
-              _default: "0"
-
-          - name: KAFKA_HOST
-            value:
-              _default: "wb-prod-kafka-bootstrap.kafka.svc.cluster.local"
-
-          - name: KAFKA_PORT
-            value:
-              _default: "9093"
-
-          - name: KAFKA_SECURITY_PROTOCOL
-            value:
-              _default: "SSL"
-
-          - name: KAFKA_SASL_MECHANISM
-            value:
-              _default: "SCRAM-SHA-512"
-
-          - name: KAFKA_SSL_CAFILE
-            value:
-              _default: "/usr/local/share/ca-certificates/kafka.crt"
-
-        secretEnvs:
-          - name: KAFKA_USERNAME
-            secretName:
-              _default: "kafka-secret"
-            secretKey: "username"
-
-          - name: KAFKA_PASSWORD
-            secretName:
-              _default: "kafka-secret"
-            secretKey: "password"
-
-          - name: DB_USERNAME
-            secretName:
-              _default: "postgres-pm-secret"
-            secretKey: "username"
-
-          - name: DB_PASSWORD
-            secretName:
-              _default: "postgres-pm-secret"
-            secretKey: "password"
-
-          - name: S3_LOGIN
-            secretName:
-              _default: "s3-secret"
-            secretKey: "username"
-
-          - name: S3_PASSWORD
-            secretName:
-              _default: "s3-secret"
-            secretKey: "password"
-
-          - name: S3_BUCKET
-            secretName:
-              _default: "s3-secret"
-            secretKey: "bucket"
-
-          - name: S3_HOST
-            secretName:
-              _default: "s3-secret"
-            secretKey: "host"
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/notes/wb/backend.yaml

@@ -1,55 +0,0 @@
----
-# Патч backend для контура wb.
-#
-# ВНИМАНИЕ: envs — список, kustomize заменяет его ЦЕЛИКОМ (JSON merge patch),
-# поэтому здесь продублирован весь набор из apps/notes/base/backend.yaml.
-#
-# DJANGO_HOST/BASE_HOST/FAAS_SERVICE/WORKSPACE_URL/WORKFLOW_HOST/RESOURCE_URL
-# в base смотрят на домен sarex.io (lk.sarex.io, api.sarex.io/<service>) —
-# для wb это lk.srx.wb.ru:30443/<service>, по аналогии с rfi/transmittal.
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: backend
-  namespace: notes
-spec:
-  values:
-    services:
-      backend:
-        envs:
-          - name: PG_SSL_MODE
-            value:
-              _default: verify-full
-          - name: DJANGO_HOST
-            value:
-              _default: https://lk.srx.wb.ru:30443
-          - name: BASE_HOST
-            value:
-              _default: https://lk.srx.wb.ru:30443/notes
-          - name: TIMEOUT
-            value:
-              _default: "120"
-          - name: FAAS_SERVICE
-            value:
-              _default: https://lk.srx.wb.ru:30443/lambdas
-          - name: WORKSPACE_URL
-            value:
-              _default: https://lk.srx.wb.ru:30443/workspaces/api/v1
-          - name: WORKFLOW_HOST
-            value:
-              _default: https://lk.srx.wb.ru:30443/workflows/api/v1
-          - name: WORKFLOW_TAG
-            value:
-              _default: stable
-          - name: RESOURCE_URL
-            value:
-              _default: https://lk.srx.wb.ru:30443/resources/api/v1
-          - name: SYNC_RESOURCE_ID
-            value:
-              _default: "0"
-          - name: ENABLE_ND
-            value:
-              _default: "0"
-          - name: ATTACHMENT_HOST
-            value:
-              _default: http://attachments-service.attachments.svc.cluster.local:80/api/v1

apps/pm/wb/backend-configmap.yaml

@@ -1,30 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: backend-configmap
-  namespace: pm
-data:
-  uwsgi.ini: |
-    [uwsgi]
-    log-format = {"time": "%(time)", "method": "%(method)", "uri": "%(uri)", "status": "%(status)", "size": "%(size)", "addr": "%(addr)", "user": "%(user)", "proto": "%(proto)", "user_agent": "%(uagent)", "referer": "%(referer)", "trace_id": "%(trace_id)", "span_id": "%(span_id)"}
-    module                 = config.wsgi:application
-    DJANGO_SETTINGS_MODULE = config.settings.base
-    http                   = 0.0.0.0:8000
-    processes              = 8
-    master                 = true
-    vacuum                 = true
-    enable-threads         = true
-    buffer-size            = 65535
-    stats                  = :3031
-    stats-http             = true
-    memory-report          = true
-    lazy-apps              = true
-    listen                 = 1024
-    disable-write-exception= 0
-    harakiri               = 300
-    socket-timeout         = 300
-    chunked-input-timeout  = 300
-    http-timeout           = 300
-    worker-reload-mercy    = 240
-    mule-reload-mercy      = 240

apps/pm/wb/backend.yaml

@@ -1,153 +0,0 @@
----
-# ENV-файл env-file (secret sarex-env, ключ .env) содержит остальные секреты
-# приложения (DB/S3/Kafka и т.п.) — в дампе кластера Secret'ы не выгружены,
-# сам файл-секрет должен уже существовать в неймспейсе pm.
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: backend
-  namespace: pm
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      backend:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/pm-backend:production_fa0f1551
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: backend
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 8000
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: true
-
-          name:
-            _default: backend-service
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 8000
-
-          targetPort:
-            _default: 8000
-
-          portName:
-            _default: http
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        volumes:
-          _default:
-            - name: uwsgi-configmap
-              mountPath:
-                _default: /opt/sarex/uwsgi.ini
-              subPath:
-                _default: uwsgi.ini
-              readOnly:
-                _default: true
-              configMap:
-                name:
-                  _default: backend-configmap
-                items:
-                  - key: uwsgi.ini
-                    path:
-                      _default: uwsgi.ini
-
-            - name: env-file
-              mountPath:
-                _default: /opt/sarex/.env
-              subPath:
-                _default: .env
-              readOnly:
-                _default: true
-              secret:
-                secretName:
-                  _default: sarex-env
-                items:
-                  - key: .env
-                    path:
-                      _default: .env
-
-            - name: kafka-cert-volume
-              mountPath:
-                _default: /usr/local/share/ca-certificates
-              readOnly:
-                _default: true
-              configMap:
-                name:
-                  _default: kafka-cert
-
-        envs:
-          - name: USERS_INTERNAL_HOST
-            value:
-              _default: "http://backend.django.svc.cluster.local:8000"
-
-          - name: RESOURCES_INTERNAL_HOST
-            value:
-              _default: "http://resources-service.resources.svc.cluster.local:8000"
-
-          - name: EAV_HOST
-            value:
-              _default: "http://eav-service.eav.svc.cluster.local:8000"
-
-          - name: EAV_API_PREFIX
-            value:
-              _default: "/api/v0"
-
-          - name: EAV_API_PREFIX_V1
-            value:
-              _default: "/api/v1"
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/pm/wb/celery.yaml

@@ -1,146 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: celery
-  namespace: pm
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      celery:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/pm-backend:production_fa0f1551
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: celery
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 8000
-
-          command:
-            _default: ["celery", "-A", "config", "worker", "-B", "-l", "info", "-E", "-Q", "pm", "-n", "default_worker.%h", "--concurrency=2"]
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: false
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        volumes:
-          _default:
-            - name: uwsgi-configmap
-              mountPath:
-                _default: /opt/sarex/uwsgi.ini
-              subPath:
-                _default: uwsgi.ini
-              readOnly:
-                _default: true
-              configMap:
-                name:
-                  _default: backend-configmap
-                items:
-                  - key: uwsgi.ini
-                    path:
-                      _default: uwsgi.ini
-
-            - name: env-file
-              mountPath:
-                _default: /opt/sarex/.env
-              subPath:
-                _default: .env
-              readOnly:
-                _default: true
-              secret:
-                secretName:
-                  _default: sarex-env
-                items:
-                  - key: .env
-                    path:
-                      _default: .env
-
-            - name: kafka-cert-volume
-              mountPath:
-                _default: /usr/local/share/ca-certificates
-              readOnly:
-                _default: true
-              configMap:
-                name:
-                  _default: kafka-cert
-
-        envs:
-          - name: PLANNING_HOST
-            value:
-              _default: "http://backend-service.pm.svc.cluster.local:8000/api/pm/msp"
-
-          - name: PLANNING_USE
-            value:
-              _default: "True"
-
-          - name: USERS_INTERNAL_HOST
-            value:
-              _default: "http://backend.django.svc.cluster.local:8000"
-
-          - name: RESOURCES_INTERNAL_HOST
-            value:
-              _default: "http://resources-service.resources.svc.cluster.local:8000"
-
-          - name: EAV_HOST
-            value:
-              _default: "http://eav-service.eav.svc.cluster.local:8000"
-
-          - name: EAV_API_PREFIX
-            value:
-              _default: "/api/v0"
-
-          - name: EAV_API_PREFIX_V1
-            value:
-              _default: "/api/v1"
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/pm/wb/kafka-cert-configmap.yaml

@@ -1,38 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: kafka-cert
-  namespace: pm
-data:
-  kafka.crt: |
-    -----BEGIN CERTIFICATE-----
-    MIIFLTCCAxWgAwIBAgIUYDZPxGRsr7IiqHEmfd07QTQlOKYwDQYJKoZIhvcNAQEN
-    BQAwLTETMBEGA1UECgwKaW8uc3RyaW16aTEWMBQGA1UEAwwNY2x1c3Rlci1jYSB2
-    MDAeFw0yNTEyMTYxNDM0NTVaFw0yNjEyMTYxNDM0NTVaMC0xEzARBgNVBAoMCmlv
-    LnN0cmltemkxFjAUBgNVBAMMDWNsdXN0ZXItY2EgdjAwggIiMA0GCSqGSIb3DQEB
-    AQUAA4ICDwAwggIKAoICAQCfzDZhEzw2pbU5Xpu8OzD+3iQG+DVjU8PQWWQEF27h
-    yjohDkUr3zCZtW7xMKWKUNxBgrKsfe4TDOQN8cij3cS9sy0So+UhMeF7Bq9PU1Yd
-    bmTRq8q1PiuNUkiCGJ5wrb3+NZvVxZLJUIFgiealsRw80MgMWWSzy0I35T2Edn/a
-    DU4jhlgQxyzQ621+oGP0n28gCjmm6pCq2tkj/Z8WTdu1gOWyRdK02a2uE2Ts2nLa
-    Di32GaZrIbIuD/WUd6Ek66uCeJvh2CT7s+SqgtMbtT7gibUuPQ3hk1VGQsjy22l3
-    hUNpLu86nrwbuf21mY55KnLOcaVq1ag1TpIIKfZAL/KWFCGZ6H6kwEIbCAL0Hei7
-    cJ2Wm2/qlzKUeU869M7YybZAfXl/t6XT4QgFgje+42N980vy5A4GhWi1Z7lPqqOe
-    jPGBstkRZybKz1sTk87+oJx82iQU/ozVmzjSEK1SoYRNbvug8PNpxmPoPnJ2flgG
-    t2q2+2ZQP3f1aAHVcZ3U5+hWlRmKPXzjrJv7gnhuvqJl7OwB50y+yWiVfZ9xrYl2
-    EpX+yHuFFK+9NnB5taUK8Fz+hQaLU8J4q7P0bRqkoI+LdcEErjuDT/eI2d5+Ql8K
-    /JkV823hX2WNB9bdaQ24BelVUbsxGpR7ms6KWrM11kHnbzUlEM+AxZES6F7Qbr55
-    TwIDAQABo0UwQzAdBgNVHQ4EFgQUM7hshx7e9TFEN82Pf446aBrJUA4wEgYDVR0T
-    AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQENBQADggIB
-    AFNHFGPDxY966fz0dxDFFSfeo47y7XQZMK9xAwH73cQoSeqx+IMxzgM8nfJQ9XMN
-    PeLwVRZ7pvRee2ZhUPglBSTHnW2rvfmLBOO9xyKZxRsCkoFxuHH9xfM7bFWb96R6
-    fGrOdEZDB3yj00T+tkubwqt+/dUhQUj8juwyPs55WMb/0BIbapaoQ6QOP13CaXDV
-    ZmAfsEEIBkNxfq7GTr/z0Rq0B4+9FxAf3Jrsmi/dYoFD/prHsvBDkYw1daoFyp5C
-    tbctvB9wtphnCCynekt8UBvpVKHUU/xaUa09TQTToXjBbV1SZeIOHNG0MNbWa4sz
-    AL/cpXdq1EAxiTeAVT9XhCwhe/xJvFZIWuFLmW3J+ZxrOUCKieCYpTqBY2tBkkDY
-    //egic787yTR6zxqQNSzvNU5LhzrN7lu+KHGM06T35+HvpzgPPiRCzsxO62p63op
-    mq04K31yYZgLiqeAj5W+rioRGJNn4TXJpH9KIrzmGM7lVWLYWMAKeZU4r1lDUdcu
-    7jsBH8BRJWJeVK3xVw2HB3lk7Xn0WrR92adeYQ3f0vKbMIAVUnSJ3yCKJ4NMFSki
-    j78nx2mi/G0RhUPGZ9hhLXQKj9BtbpEnwpbGWtf0ShtVOxD/HKLCr7koBtW9TMPS
-    9K0sJhE5VjsQLkDDu9p3GdRcuLNA/oa7xFvRFtqGFsLj
-    -----END CERTIFICATE-----

apps/pm/wb/kustomization.yaml

@@ -1,10 +0,0 @@
----
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: pm
-resources:
-  - backend-configmap.yaml
-  - kafka-cert-configmap.yaml
-  - backend.yaml
-  - celery.yaml
-  - redis.yaml

apps/pm/wb/redis.yaml

@@ -1,88 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: redis
-  namespace: pm
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      redis:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/redis:latest
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: redis
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 6379
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: true
-
-          name:
-            _default: redis
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 6379
-
-          targetPort:
-            _default: 6379
-
-          portName:
-            _default: tcp
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/processing/aero/kustomization.yaml

@@ -0,0 +1,309 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: processing
+resources:
+  - ../base
+
+patches:
+  # --- Состав: только api и engine-low ---------------------------------------
+  # engine удалён: в base у него replicaCount 0, то есть он и там выключен, а
+  # образ прибит к тегу с опечаткой в имени (workflows-endigne_prod). Рабочий
+  # обработчик — engine-low, он же на более свежем образе contour_*.
+  - target: {kind: HelmRelease, name: engine}
+    patch: |
+      $patch: delete
+      apiVersion: helm.toolkit.fluxcd.io/v2
+      kind: HelmRelease
+      metadata:
+        name: engine
+        namespace: processing
+
+  # frontend идёт из base без патчей. Адреса бэкендов вшиты в бандл на этапе
+  # сборки (константа __BUILD_ENV__), но сборка ugok2 обращается к тому же
+  # origin относительными путями — иначе в остальных кластерах не понадобился
+  # бы отдельный маршрут /workflows/api/ перед /workflows/. Поэтому фронтенд
+  # публикуется на домене платформы, а не на своём поддомене: маршруты в
+  # infrastructure/istio-config/aero, VirtualService platform.
+
+  # --- workflows-api ----------------------------------------------------------
+  - target: {kind: HelmRelease, name: workflows-api}
+    patch: |
+      # S3 приезжает из Vault отдельным ФАЙЛОМ, а не парой переменных:
+      # приложение читает по этому пути целый JSON. В base путь ведёт в
+      # /etc/sarex/yc-s3/, куда в контуре ничего не смонтировано.
+      - op: test
+        path: /spec/values/services/backend/envs/3/name
+        value: S3_SERVICE_ACCOUNT
+      - op: replace
+        path: /spec/values/services/backend/envs/3/value/_default
+        value: /vault/secrets/processing-s3
+      - op: add
+        path: /spec/values/services/backend/podAnnotations/_default/vault.hashicorp.com~1agent-inject-secret-processing-s3
+        value: secrets/data/minio/apps/processing
+      - op: add
+        path: /spec/values/services/backend/podAnnotations/_default/vault.hashicorp.com~1agent-inject-template-processing-s3
+        value: |-
+          {{- with secret "secrets/data/minio/apps/processing" -}}
+          {
+            "host": "{{ index .Data.data "host" }}",
+            "bucket": "{{ index .Data.data "bucket" }}",
+            "access_key_id": "{{ index .Data.data "access_key_id" }}",
+            "secret_access_key": "{{ index .Data.data "secret_access_key" }}",
+            "region": "{{ index .Data.data "region" }}",
+            "verify": false
+          }
+          {{- end -}}
+
+  # --- engine-low -------------------------------------------------------------
+  # Патчи адресуются по индексу, поэтому перед каждым replace идёт op: test на
+  # имя переменной. Если в base порядок envs изменится, сборка упадёт явно,
+  # вместо того чтобы молча перезаписать соседнее значение.
+  - target: {kind: HelmRelease, name: engine-low}
+    patch: |
+      # Sentry — внешний домен, из контура недостижим. Значение прокидывается
+      # ещё и в каждый под задачи, поэтому зануляем в одном месте.
+      - op: test
+        path: /spec/values/services/backend/envs/2/name
+        value: WORKFLOWS_SENTRY_DSN
+      - op: replace
+        path: /spec/values/services/backend/envs/2/value/_default
+        value: ""
+
+      # В base адрес django неверный даже для кластеров, где он есть: сервис
+      # называется backend-svc и слушает 80, а не backend:8000. У api то же
+      # значение уже правильное.
+      - op: test
+        path: /spec/values/services/backend/envs/5/name
+        value: DJANGO_HOST
+      - op: replace
+        path: /spec/values/services/backend/envs/5/value/_default
+        value: http://backend-svc.django.svc.cluster.local:80
+
+      # S3 — как у api выше.
+      - op: test
+        path: /spec/values/services/backend/envs/6/name
+        value: S3_SERVICE_ACCOUNT
+      - op: replace
+        path: /spec/values/services/backend/envs/6/value/_default
+        value: /vault/secrets/processing-s3
+
+      # SMTP выключаем целиком: почтового релея в контуре нет. Вместе с флагом
+      # убираем аннотацию инжекции secrets/vault/common/smtp_auth — секрета в
+      # Vault нет, а vault-agent-init на несуществующем секрете не отрендерит
+      # шаблон и оставит под в Init:Error, до флага дело не дойдёт.
+      - op: test
+        path: /spec/values/services/backend/envs/23/name
+        value: ENABLE_SMTP
+      - op: replace
+        path: /spec/values/services/backend/envs/23/value/_default
+        value: "0"
+      - op: remove
+        path: /spec/values/services/backend/podAnnotations/_default/vault.hashicorp.com~1agent-inject-secret-processing-smtp
+      - op: remove
+        path: /spec/values/services/backend/podAnnotations/_default/vault.hashicorp.com~1agent-inject-template-processing-smtp
+
+      # Смежные сервисы, которых в контуре нет: documentations (PDM,
+      # filestream), resources, bim-api, workspace, issues, comparisons,
+      # mailgun. Оставляем только S3 — единственное внешнее хранилище, которое
+      # в aero действительно есть.
+      - op: test
+        path: /spec/values/services/backend/envs/22/name
+        value: ENABLE_PDM_STORAGE
+      - op: replace
+        path: /spec/values/services/backend/envs/22/value/_default
+        value: "0"
+      - op: test
+        path: /spec/values/services/backend/envs/26/name
+        value: ENABLE_BIM_API_V2_DB
+      - op: replace
+        path: /spec/values/services/backend/envs/26/value/_default
+        value: "0"
+      - op: test
+        path: /spec/values/services/backend/envs/27/name
+        value: ENABLE_WORKSPACE_API_DB
+      - op: replace
+        path: /spec/values/services/backend/envs/27/value/_default
+        value: "0"
+      - op: test
+        path: /spec/values/services/backend/envs/28/name
+        value: ENABLE_ISSUE_API_DB
+      - op: replace
+        path: /spec/values/services/backend/envs/28/value/_default
+        value: "0"
+      - op: test
+        path: /spec/values/services/backend/envs/29/name
+        value: ENABLE_RESOURCES_API
+      - op: replace
+        path: /spec/values/services/backend/envs/29/value/_default
+        value: "0"
+      - op: test
+        path: /spec/values/services/backend/envs/31/name
+        value: ENABLE_PDM_API_DB
+      - op: replace
+        path: /spec/values/services/backend/envs/31/value/_default
+        value: "0"
+      - op: test
+        path: /spec/values/services/backend/envs/32/name
+        value: ENABLE_COMPARISONS_API_DB
+      - op: replace
+        path: /spec/values/services/backend/envs/32/value/_default
+        value: "0"
+      - op: test
+        path: /spec/values/services/backend/envs/33/name
+        value: ENABLE_MAIL_GUN
+      - op: replace
+        path: /spec/values/services/backend/envs/33/value/_default
+        value: "0"
+
+      # Планирование подов задач. engine работает kubernetes-исполнителем и сам
+      # создаёт Job'ы, подставляя им nodeSelector dedicated=processing и
+      # соответствующий toleration. Выделенных нод в контуре нет — все три
+      # равнозначны, — поэтому поды задач висли бы в Pending с
+      #   didn't match Pod's node affinity/selector
+      # ровно как это было у postgresql (см. postRenderers в его релизе).
+      #
+      # ENABLE_TOLERATION ЗДЕСЬ НЕ ВЫКЛЮЧАТЬ. Сначала я поставил его в "0" — и
+      # это тихо сломало запуск задач совсем: в движке классы ресурсов
+      # регистрируются ПОД ЭТИМ ЖЕ ФЛАГОМ,
+      #   if resCfg.EnableToleration { services[HighResources] = ... }
+      # (pkg/kube_services/services.go), поэтому задача с service_request
+      # "high-resources" падала не на планировании, а раньше — на разборе:
+      #   ERROR create k8s job: create k8s job: unknown service
+      # Ни одного пода при этом не создавалось, и в логе не было ни слова про
+      # nodeSelector, так что связь с этим флагом неочевидна.
+      #
+      # Вместо выключения переводим селектор на метку, которая есть на всех
+      # нодах, — kubernetes.io/os=linux. Класс сервисов остаётся
+      # зарегистрированным, nodeSelector совпадает с любой нодой, а toleration
+      # на несуществующий taint безвреден. Запрашиваемые ресурсы трогать не
+      # надо: в base это 1 CPU и 1Gi.
+      #
+      # IGNORE_TAINTS_AND_NODE_SELECTOR (появился в base из master) полагаться
+      # на него не стоит: в master workflows-engine такой переменной нет. Образ
+      # при этом contour_a03d37da-dirty2 — ручная сборка, поднятая тем же
+      # коммитом master, что добавил переменную, так что она там, вероятно,
+      # поддержана. Проверить нечем, поэтому селектор задан явно, а не через
+      # неё; вреда от того, что она выставлена в base, нет.
+      - op: test
+        path: /spec/values/services/backend/envs/53/name
+        value: TOLERATION_KEY
+      - op: replace
+        path: /spec/values/services/backend/envs/53/value/_default
+        value: kubernetes.io/os
+      - op: test
+        path: /spec/values/services/backend/envs/54/name
+        value: TOLERATION_VALUE
+      - op: replace
+        path: /spec/values/services/backend/envs/54/value/_default
+        value: linux
+      - op: test
+        path: /spec/values/services/backend/envs/55/name
+        value: TOLERATION_KEY_HIGH_MEM
+      - op: replace
+        path: /spec/values/services/backend/envs/55/value/_default
+        value: kubernetes.io/os
+      - op: test
+        path: /spec/values/services/backend/envs/56/name
+        value: TOLERATION_VALUE_HIGH_MEM
+      - op: replace
+        path: /spec/values/services/backend/envs/56/value/_default
+        value: linux
+      - op: test
+        path: /spec/values/services/backend/envs/57/name
+        value: TOLERATION_KEY_PERSISTENT
+      - op: replace
+        path: /spec/values/services/backend/envs/57/value/_default
+        value: kubernetes.io/os
+      - op: test
+        path: /spec/values/services/backend/envs/58/name
+        value: TOLERATION_VALUE_PERSISTENT
+      - op: replace
+        path: /spec/values/services/backend/envs/58/value/_default
+        value: linux
+      - op: test
+        path: /spec/values/services/backend/envs/70/name
+        value: DEFAULT_NODE_SELECTOR_KEY
+      - op: replace
+        path: /spec/values/services/backend/envs/70/value/_default
+        value: kubernetes.io/os
+      - op: test
+        path: /spec/values/services/backend/envs/71/name
+        value: DEFAULT_NODE_SELECTOR_VALUE
+      - op: replace
+        path: /spec/values/services/backend/envs/71/value/_default
+        value: linux
+
+      # --- Vault для ПОДОВ ЗАДАЧ, а не для самого движка ----------------------
+      # В сборке contour_a03d37da-dirty2 движок умеет не монтировать в Job
+      # готовый Secret, а вешать на него аннотации vault-agent — тогда файл
+      # с кредами кладёт агент, и Secret в namespace задач не нужен вовсе.
+      # Именно так это работает в UGMK, где никакого yc-s3 в namespace нет.
+      #
+      # В master workflows-engine этого кода нет (сборка с невлитой ветки),
+      # поэтому набор переменных восстановлен по строкам бинарника:
+      #   VAULT_ROLE, VAULT_SA, VAULT_MOUNT_PATH
+      #   vault.hashicorp.com/{role,secret-volume-path,agent-inject-file-*,
+      #                        agent-inject-secret-*,agent-inject-template-*}
+      #   yc-s3, yc-s3-service-account.json, /etc/sarex/yc-s3
+      #
+      # В base задан только VAULT_USE=true — остальных трёх нет НИ В ОДНОМ
+      # кластере репозитория, поэтому аннотации выходили неполными, агент в под
+      # задачи ничего не клал, и файл читался как пустой:
+      #   ValueError: SERVICE_S3 is not valid
+      #   Expecting value: line 1 column 1 (char 0)
+      #
+      # Переменных нет в base, поэтому op: add с "-" (добавление в конец
+      # списка), а не replace по индексу.
+      - op: add
+        path: /spec/values/services/backend/envs/-
+        value:
+          name: VAULT_ROLE
+          value:
+            _default: processing
+      - op: add
+        path: /spec/values/services/backend/envs/-
+        value:
+          name: VAULT_SA
+          value:
+            _default: processing-vault
+      # VAULT_MOUNT_PATH — вопреки имени НЕ корень KV, а ПОЛНЫЙ путь секрета:
+      # движок подставляет значение в шаблон целиком. Проверено по аннотациям
+      # созданного пода задачи:
+      #   agent-inject-secret-yc-s3: <VAULT_MOUNT_PATH>
+      #   agent-inject-template-yc-s3:
+      #     {{- with secret "<VAULT_MOUNT_PATH>" -}}
+      #     {{ index .Data.data "yc-s3-service-account.json" }}
+      # Отсюда два следствия: путь пишется в форме чтения KV v2 (с /data/), а в
+      # секрете обязан быть ключ с именем ФАЙЛА.
+      #
+      # Путь ОДИН НА ВСЕ ФАЙЛЫ, которые движок кладёт в поды задач: он
+      # подставляет VAULT_MOUNT_PATH в каждую аннотацию, меняя только имя
+      # ключа. Так, для django-auth аннотация ссылается на этот же путь и ищет
+      # в нём ключ django-auth.json. Поэтому имя пути нейтральное (job-files),
+      # а не по имени одного из файлов, — иначе оно врёт о содержимом.
+      # Сам секрет кладёт ansible, vault_app_secrets.
+      - op: add
+        path: /spec/values/services/backend/envs/-
+        value:
+          name: VAULT_MOUNT_PATH
+          value:
+            _default: secrets/data/apps/processing/job-files
+
+      # S3 из Vault, как у api.
+      - op: add
+        path: /spec/values/services/backend/podAnnotations/_default/vault.hashicorp.com~1agent-inject-secret-processing-s3
+        value: secrets/data/minio/apps/processing
+      - op: add
+        path: /spec/values/services/backend/podAnnotations/_default/vault.hashicorp.com~1agent-inject-template-processing-s3
+        value: |-
+          {{- with secret "secrets/data/minio/apps/processing" -}}
+          {
+            "host": "{{ index .Data.data "host" }}",
+            "bucket": "{{ index .Data.data "bucket" }}",
+            "access_key_id": "{{ index .Data.data "access_key_id" }}",
+            "secret_access_key": "{{ index .Data.data "secret_access_key" }}",
+            "region": "{{ index .Data.data "region" }}",
+            "verify": false
+          }
+          {{- end -}}

apps/processing/wb/engine-low.yaml

@@ -1,226 +0,0 @@
----
-# Сырой Deployment (копия из дампа кластера), а не HelmRelease/universal-chart —
-# см. apps/processing/wb/engine.yaml.
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: engine-low
-  namespace: workflow
-  labels:
-    app: engine-low
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: engine-low
-  template:
-    metadata:
-      labels:
-        app: engine-low
-    spec:
-      serviceAccountName: workflows-backend-sa
-      automountServiceAccountToken: true
-      imagePullSecrets:
-        - name: dockerhub
-      containers:
-        - name: engine-low
-          image: cr.yandex/crp3ccidau046kdj8g9q/workflows-engine:production_f5fe4688
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 8080
-              protocol: TCP
-          env:
-            - name: RABBITMQ_HOST
-              value: "rabbitmq-service.workflow.svc.cluster.local"
-            - name: RABBITMQ_PORT
-              value: "5672/api"
-            - name: POSTGRES_ADDRESS
-              value: "sarex-vpsql-01.xc.wb.ru"
-            - name: POSTGRES_PORT
-              value: "5432"
-            - name: POSTGRES_POOL_SIZE
-              value: "20"
-            - name: ENVIRONMENT
-              value: "prod"
-            - name: WORKFLOWS_SENTRY_DSN
-              value: "https://866b532efdbb4764a7551b76231232fc@o279218.ingest.sentry.io/543123"
-            - name: WORKFLOWS_SENTRY_DEBUG
-              value: "0"
-            - name: API_ADDRESS
-              value: "0.0.0.0:8000"
-            - name: DJANGO_HOST
-              value: "http://backend.django.svc.cluster.local:8000"
-            - name: S3_SERVICE_ACCOUNT
-              value: "/etc/sarex/yc-s3/yc-s3-service-account.json"
-            - name: BIM_API_V2_DB
-              value: "/etc/sarex/bim-api-v2-db-prod.json"
-            - name: PDM_API_DB
-              value: "/etc/pdm/pdm-api-db-prod.json"
-            - name: WORKSPACE_API_DB
-              value: "/etc/ws/ws-api-db-prod.json"
-            - name: ISSUE_API_DB
-              value: "/etc/issues/issue-api-db-prod.json"
-            - name: MAILGUN
-              value: "/etc/mailgun-secret/env.json"
-            - name: SMTP
-              value: "/etc/smtp-secret/smtp.json"
-            - name: INTERNAL_PDM_URL
-              value: "http://documentations-api.documentations.svc.cluster.local:8080"
-            - name: INTERNAL_FILESTREAM_URL
-              value: "http://documentations-filestream.documentations.svc.cluster.local:8080"
-            - name: EXTERNAL_PDM_URL
-              value: "http://documentations-api.documentations.svc.cluster.local:8080"
-            - name: EXTERNAL_FILESTREAM_URL
-              value: "http://documentations-filestream-service.documentations.svc.cluster.local:8080"
-            - name: RESOURCES_API_INTERNAL_HOST
-              value: "http://resources-service.resources.svc.cluster.local:8000"
-            - name: ENABLE_SQL_QUERY
-              value: "0"
-            - name: ENABLE_S3_STORAGE
-              value: "1"
-            - name: ENABLE_S3V2_STORAGE
-              value: "1"
-            - name: ENABLE_PDM_STORAGE
-              value: "1"
-            - name: ENABLE_SMTP
-              value: "1"
-            - name: ENABLE_URL_STORAGE
-              value: "1"
-            - name: ENABLE_SRX_TMP
-              value: "1"
-            - name: ENABLE_BIM_API_V2_DB
-              value: "1"
-            - name: ENABLE_WORKSPACE_API_DB
-              value: "1"
-            - name: ENABLE_ISSUE_API_DB
-              value: "1"
-            - name: ENABLE_RESOURCES_API
-              value: "1"
-            - name: ENABLE_PDM_API_DB
-              value: "1"
-            - name: ENABLE_COMPARISONS_API_DB
-              value: "1"
-            - name: ENABLE_MAIL_GUN
-              value: "1"
-            - name: ENABLE_AMQP_EXECUTOR
-              value: "0"
-            - name: ENABLE_KUBERNETES_EXECUTOR
-              value: "1"
-            - name: MAX_WORKFLOWS_LIMIT
-              value: "5"
-            - name: CPU_COUNT
-              value: "1"
-            - name: MEMORY_GI
-              value: "1"
-            - name: CPU_COUNT_LOW_RESOURCES
-              value: "1"
-            - name: MEMORY_GI_LOW_RESOURCES
-              value: "1"
-            - name: CPU_COUNT_HIGH_MEM
-              value: "1"
-            - name: MEMORY_GI_HIGH_MEM
-              value: "1"
-            - name: ENABLE_TOLERATION
-              value: "1"
-            - name: COUNT_RUNNING_WORKERS
-              value: "1"
-            - name: COUNT_CANCELING_WORKERS
-              value: "1"
-            - name: COUNT_HANDLE_JOB_WORKERS
-              value: "1"
-            - name: BIM_API_DEBUG
-              value: "0"
-            - name: BIM_API_V2_DEBUG
-              value: "0"
-            - name: PDM_API_DEBUG
-              value: "0"
-            - name: COMPARISONS_API_DEBUG
-              value: "0"
-            - name: WORKSPACE_API_DEBUG
-              value: "0"
-            - name: JOBS_NAMESPACE
-              value: "workflow"
-            - name: ISSUE_API_DEBUG
-              value: "0"
-            - name: TOLERATION_KEY
-              value: "dedicated"
-            - name: TOLERATION_VALUE
-              value: "processing-light"
-            - name: TOLERATION_KEY_HIGH_MEM
-              value: "dedicated"
-            - name: TOLERATION_VALUE_HIGH_MEM
-              value: "processing-light"
-            - name: TOLERATION_KEY_PERSISTENT
-              value: "dedicated"
-            - name: TOLERATION_VALUE_PERSISTENT
-              value: "processing-light"
-            - name: RABBITMQ_CREATE_EXCHANGE
-              value: "autodesk.inputMessage"
-            - name: RABBITMQ_CANCEL_EXCHANGE
-              value: "autodesk.cancelMessage"
-            - name: RABBITMQ_CREATE_ROUTING_KEY
-              value: "converting"
-            - name: RABBITMQ_CANCEL_TOPIC
-              value: "cancel"
-            - name: RABBITMQ_COMPLETENESS_EXCHANGE
-              value: "autodesk.outputMessage"
-            - name: RABBITMQ_COMPLETENESS_TOPIC
-              value: "output_navis"
-            - name: CONTROL_PLANE_PERIOD
-              value: "10s"
-            - name: WORKFLOW_PRIORITY
-              value: "low"
-            - name: DEFAULT_TOLERATION_KEY
-              value: "dedicated"
-            - name: DEFAULT_TOLERATION_VALUE
-              value: "processing-light"
-            - name: DEFAULT_NODE_SELECTOR_KEY
-              value: "dedicated"
-            - name: DEFAULT_NODE_SELECTOR_VALUE
-              value: "processing-light"
-            - name: RABBITMQ_USER
-              valueFrom:
-                secretKeyRef:
-                  name: rabbitmq-secret
-                  key: username
-            - name: RABBITMQ_PASS
-              valueFrom:
-                secretKeyRef:
-                  name: rabbitmq-secret
-                  key: password
-            - name: POSTGRES_USER
-              valueFrom:
-                secretKeyRef:
-                  name: postgres-secret
-                  key: username
-            - name: POSTGRES_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: postgres-secret
-                  key: password
-            - name: POSTGRES_DB
-              valueFrom:
-                secretKeyRef:
-                  name: postgres-secret
-                  key: database
-          volumeMounts:
-            - name: yc-s3
-              mountPath: /etc/sarex/yc-s3
-              readOnly: true
-            - name: django-auth
-              mountPath: /etc/django-auth
-              readOnly: true
-            - name: smtp-secret
-              mountPath: /etc/smtp-secret
-              readOnly: true
-      volumes:
-        - name: yc-s3
-          secret:
-            secretName: yc-s3
-        - name: django-auth
-          secret:
-            secretName: django-auth
-        - name: smtp-secret
-          secret:
-            secretName: smtp-secret

apps/processing/wb/engine.yaml

@@ -1,223 +0,0 @@
----
-# Сырой Deployment (копия из дампа кластера), а не HelmRelease/universal-chart —
-# на universal-chart не удалось надёжно выставить serviceAccountName +
-# automountServiceAccountToken (см. историю в git), решили не гадать дальше.
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: engine
-  namespace: workflow
-  labels:
-    app: engine
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: engine
-  template:
-    metadata:
-      labels:
-        app: engine
-    spec:
-      serviceAccountName: workflows-backend-sa
-      automountServiceAccountToken: true
-      imagePullSecrets:
-        - name: dockerhub
-      containers:
-        - name: engine
-          image: cr.yandex/crp3ccidau046kdj8g9q/workflows-engine:production_f5fe4688
-          imagePullPolicy: IfNotPresent
-          ports:
-            - name: http
-              containerPort: 8080
-              protocol: TCP
-          env:
-            - name: TOLERATION_KEY
-              value: "dedicated"
-            - name: DEFAULT_TOLERATION_KEY
-              value: "dedicated"
-            - name: DEFAULT_TOLERATION_VALUE
-              value: "processing-light"
-            - name: TOLERATION_VALUE
-              value: "processing-light"
-            - name: TOLERATION_KEY_HIGH_MEM
-              value: "dedicated"
-            - name: TOLERATION_VALUE_HIGH_MEM
-              value: "processing-light"
-            - name: TOLERATION_KEY_PERSISTENT
-              value: "dedicated"
-            - name: TOLERATION_VALUE_PERSISTENT
-              value: "processing-light"
-            - name: RABBITMQ_HOST
-              value: "rabbitmq.rabbitmq.svc.cluster.local"
-            - name: RABBITMQ_PORT
-              value: "5672/cad"
-            - name: POSTGRES_ADDRESS
-              value: "sarex-vpsql-01.xc.wb.ru"
-            - name: POSTGRES_PORT
-              value: "5432"
-            - name: WORKFLOWS_SENTRY_DSN
-              value: "https://866b532efdbb4764a7551b76231232fc@o279218.ingest.sentry.io/543123"
-            - name: WORKFLOWS_SENTRY_DEBUG
-              value: "0"
-            - name: POSTGRES_POOL_SIZE
-              value: "20"
-            - name: ENABLE_SMTP
-              value: "1"
-            - name: SMTP
-              value: "/etc/smtp-secret/smtp.json"
-            - name: ENVIRONMENT
-              value: "prod"
-            - name: API_ADDRESS
-              value: "0.0.0.0:8000"
-            - name: DJANGO_HOST
-              value: "http://backend.django.svc.cluster.local:8000"
-            - name: S3_SERVICE_ACCOUNT
-              value: "/etc/sarex/yc-s3/yc-s3-service-account.json"
-            - name: BIM_API_V2_DB
-              value: "/etc/sarex/bim-api-v2-db-prod.json"
-            - name: PDM_API_DB
-              value: "/etc/pdm/pdm-api-db-prod.json"
-            - name: WORKSPACE_API_DB
-              value: "/etc/ws/ws-api-db-prod.json"
-            - name: ISSUE_API_DB
-              value: "/etc/issues/issue-api-db-prod.json"
-            - name: MAILGUN
-              value: "/etc/mailgun-secret/env.json"
-            - name: INTERNAL_PDM_URL
-              value: "http://documentations-api.documentations.svc.cluster.local:8080"
-            - name: INTERNAL_FILESTREAM_URL
-              value: "http://documentations-filestream.documentations.svc.cluster.local:8080"
-            - name: EXTERNAL_PDM_URL
-              value: "http://documentations-api.documentations.svc.cluster.local:8080"
-            - name: EXTERNAL_FILESTREAM_URL
-              value: "http://documentations-filestream-service.documentations.svc.cluster.local:8080"
-            - name: RESOURCES_API_INTERNAL_HOST
-              value: "http://resources-service.resources.svc.cluster.local:8000"
-            - name: ENABLE_SQL_QUERY
-              value: "0"
-            - name: ENABLE_S3_STORAGE
-              value: "1"
-            - name: ENABLE_S3V2_STORAGE
-              value: "1"
-            - name: ENABLE_PDM_STORAGE
-              value: "1"
-            - name: ENABLE_URL_STORAGE
-              value: "1"
-            - name: ENABLE_SRX_TMP
-              value: "1"
-            - name: ENABLE_BIM_API_V2_DB
-              value: "1"
-            - name: ENABLE_WORKSPACE_API_DB
-              value: "1"
-            - name: ENABLE_ISSUE_API_DB
-              value: "1"
-            - name: ENABLE_RESOURCES_API
-              value: "1"
-            - name: ENABLE_PDM_API_DB
-              value: "1"
-            - name: ENABLE_COMPARISONS_API_DB
-              value: "1"
-            - name: ENABLE_MAIL_GUN
-              value: "0"
-            - name: ENABLE_AMQP_EXECUTOR
-              value: "1"
-            - name: ENABLE_KUBERNETES_EXECUTOR
-              value: "1"
-            - name: MAX_WORKFLOWS_LIMIT
-              value: "5"
-            - name: CPU_COUNT
-              value: "1"
-            - name: MEMORY_GI
-              value: "1"
-            - name: CPU_COUNT_LOW_RESOURCES
-              value: "1"
-            - name: MEMORY_GI_LOW_RESOURCES
-              value: "1"
-            - name: CPU_COUNT_HIGH_MEM
-              value: "1"
-            - name: MEMORY_GI_HIGH_MEM
-              value: "1"
-            - name: ENABLE_TOLERATION
-              value: "1"
-            - name: COUNT_RUNNING_WORKERS
-              value: "1"
-            - name: COUNT_CANCELING_WORKERS
-              value: "1"
-            - name: COUNT_HANDLE_JOB_WORKERS
-              value: "1"
-            - name: BIM_API_DEBUG
-              value: "0"
-            - name: BIM_API_V2_DEBUG
-              value: "0"
-            - name: PDM_API_DEBUG
-              value: "0"
-            - name: COMPARISONS_API_DEBUG
-              value: "0"
-            - name: WORKSPACE_API_DEBUG
-              value: "0"
-            - name: JOBS_NAMESPACE
-              value: "workflow"
-            - name: ISSUE_API_DEBUG
-              value: "0"
-            - name: RABBITMQ_CREATE_EXCHANGE
-              value: "autodesk.inputMessage"
-            - name: RABBITMQ_CANCEL_EXCHANGE
-              value: "autodesk.cancelMessage"
-            - name: RABBITMQ_CREATE_ROUTING_KEY
-              value: "converting"
-            - name: RABBITMQ_CANCEL_TOPIC
-              value: "cancel"
-            - name: RABBITMQ_COMPLETENESS_EXCHANGE
-              value: "autodesk.outputMessage"
-            - name: RABBITMQ_COMPLETENESS_TOPIC
-              value: "output"
-            - name: CONTROL_PLANE_PERIOD
-              value: "10s"
-            - name: WORKFLOW_PRIORITY
-              value: "high"
-            - name: RABBITMQ_USER
-              valueFrom:
-                secretKeyRef:
-                  name: rabbitmq-secret
-                  key: username
-            - name: RABBITMQ_PASS
-              valueFrom:
-                secretKeyRef:
-                  name: rabbitmq-secret
-                  key: password
-            - name: POSTGRES_USER
-              valueFrom:
-                secretKeyRef:
-                  name: postgres-secret
-                  key: username
-            - name: POSTGRES_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: postgres-secret
-                  key: password
-            - name: POSTGRES_DB
-              valueFrom:
-                secretKeyRef:
-                  name: postgres-secret
-                  key: database
-          volumeMounts:
-            - name: yc-s3
-              mountPath: /etc/sarex/yc-s3
-              readOnly: true
-            - name: django-auth
-              mountPath: /etc/django-auth
-              readOnly: true
-            - name: smtp-secret
-              mountPath: /etc/smtp-secret
-              readOnly: true
-      volumes:
-        - name: yc-s3
-          secret:
-            secretName: yc-s3
-        - name: django-auth
-          secret:
-            secretName: django-auth
-        - name: smtp-secret
-          secret:
-            secretName: smtp-secret

apps/processing/wb/frontend.yaml

@@ -1,88 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: frontend
-  namespace: workflow
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      frontend:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/workflows-frontend:ugok2_85f6ce2c
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: frontend
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 8080
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: true
-
-          name:
-            _default: frontend-service
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 8080
-
-          targetPort:
-            _default: 8080
-
-          portName:
-            _default: http
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""

apps/processing/wb/kustomization.yaml

@@ -1,11 +0,0 @@
----
-# processing разворачивается в wb в неймспейс workflow (не processing).
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: workflow
-resources:
-  - rbac.yaml
-  - engine.yaml
-  - engine-low.yaml
-  - frontend.yaml
-  - workflows-api.yaml

apps/processing/wb/rbac.yaml

@@ -1,41 +0,0 @@
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: workflows-backend-jobs
-  namespace: workflow
-rules:
-  - apiGroups:
-      - batch
-    resources:
-      - jobs
-    verbs:
-      - get
-      - list
-      - watch
-      - create
-      - update
-      - patch
-      - delete
-  - apiGroups:
-      - ""
-    resources:
-      - pods
-    verbs:
-      - get
-      - list
-      - watch
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: workflows-backend-jobs
-  namespace: workflow
-subjects:
-  - kind: ServiceAccount
-    name: workflows-backend-sa
-    namespace: workflow
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: workflows-backend-jobs

apps/processing/wb/workflows-api.yaml

@@ -1,142 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: workflows-api
-  namespace: workflow
-
-spec:
-  interval: 10m
-
-  chart:
-    spec:
-      chart: universal-chart
-      version: "0.1.7"
-      sourceRef:
-        kind: HelmRepository
-        name: yc-oci-charts
-        namespace: flux-system
-      interval: 10m
-
-  install:
-    remediation:
-      retries: 3
-
-  upgrade:
-    remediation:
-      retries: 3
-
-  values:
-    global:
-      env: _default
-
-    services:
-      workflows-api:
-        enabled: true
-
-        image:
-          name:
-            _default: cr.yandex/crp3ccidau046kdj8g9q/workflows-api:prod_e963403f
-          pullPolicy:
-            _default: IfNotPresent
-
-        deployment:
-          enabled: true
-
-          name:
-            _default: workflows-api
-
-          replicaCount:
-            _default: 1
-
-          port:
-            _default: 8080
-
-          probes:
-            liveness:
-              enabled: false
-            readiness:
-              enabled: false
-
-        service:
-          enabled: true
-
-          name:
-            _default: workflows-api-service
-
-          type:
-            _default: ClusterIP
-
-          port:
-            _default: 8000
-
-          targetPort:
-            _default: 8080
-
-          portName:
-            _default: http
-
-        imagePullSecrets:
-          enabled:
-            _default: true
-          name:
-            _default: dockerhub
-
-        envs:
-          - name: POSTGRES_ADDRESS
-            value:
-              _default: "sarex-vpsql-01.xc.wb.ru"
-
-          - name: POSTGRES_PORT
-            value:
-              _default: "5432"
-
-          - name: POSTGRES_POOL_SIZE
-            value:
-              _default: "3"
-
-          - name: HTTP_HOST
-            value:
-              _default: "0.0.0.0:8080"
-
-          - name: DJANGO_HOST
-            value:
-              _default: "http://backend.django.svc.cluster.local:8000"
-
-          - name: S3_SERVICE_ACCOUNT
-            value:
-              _default: "/etc/sarex/yc-s3/yc-s3-service-account.json"
-
-          - name: ENABLE_SQL_QUERY
-            value:
-              _default: "0"
-
-          - name: POSTGRES_SSL_USE
-            value:
-              _default: "0"
-
-        secretEnvs:
-          - name: POSTGRES_USER
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "username"
-
-          - name: POSTGRES_PASSWORD
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "password"
-
-          - name: POSTGRES_DB
-            secretName:
-              _default: "postgres-secret"
-            secretKey: "database"
-
-          - name: PUBLIC_KEY
-            secretName:
-              _default: "public-key"
-            secretKey: "key"
-
-        commitSha: ""
-        gitlabUri: ""
-        gitlabJobUrl: ""
-        owner: ""