From f0f84b1baa8e16cf4b827ed1e555ed0a681b1d34 Mon Sep 17 00:00:00 2001 From: "Zimin A.N." Date: Thu, 7 May 2026 15:24:03 +0300 Subject: [PATCH] =?UTF-8?q?docs(status):=20v1.0=20=E2=80=94=20production?= =?UTF-8?q?=20LIVE=20=D0=BD=D0=B0=20cluster.142,=20=D0=90=D0=BB=D1=8C?= =?UTF-8?q?=D1=82=D1=83=D0=BC=20=D0=BF=D0=B5=D1=80=D0=B5=D0=B5=D1=85=D0=B0?= =?UTF-8?q?=D0=BB?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Snapshot после Phase 1-5 production stand-up done: - prod (cluster.142): LIVE, helm rev 22 на main-4252ad93, Альтум blue/green cutover завершён - staging (cluster.265): теперь dev environment, не consumer-facing - v0.9 → v1.0 anchor Что задеплоено в prod (8 commits сегодня): - bulk close + bulk export CSV - audit URL persistence + chips - pagination для records list (50/page) - WebhookE2ETest re-enabled (no-op scheduler) - 23 новых тестов Operational artifacts (ordinis-infra): - k8s/kafka/cluster-prod.yaml (Kafka recovery) - scripts/vault/{setup,populate}.sh + README Открытые items: KafkaTopics READY=False (orphaned), postgis-barman image mirror в prod registry, k6 prod benchmark, real ЦУОД data integration epic. Approval workflow v2 deferred — design doc сохранён, re-evaluate через 1-2 месяца после observed compliance needs. --- docs/status/2026-05-07-state.md | 142 ++++++++++++++++++++++++++++++++ 1 file changed, 142 insertions(+) create mode 100644 docs/status/2026-05-07-state.md diff --git a/docs/status/2026-05-07-state.md b/docs/status/2026-05-07-state.md new file mode 100644 index 0000000..46de250 --- /dev/null +++ b/docs/status/2026-05-07-state.md @@ -0,0 +1,142 @@ +# Состояние разработки НСИ (Ordinis ЦУОД ОДХ) + +**Версия:** v1.0 (anchor v1 — production LIVE на cluster.142, Альтум переехал) +**Дата:** 2026-05-07 +**Owner:** zimin.an@nstart.space +**Окружения:** +- **prod** (192.168.100.142 / cluster.142, ✅ LIVE с Альтум traffic, blue/green cutover завершён) +- **staging** (192.168.100.161 / cluster.265, ✅ STABLE — теперь dev environment, не consumer-facing) +**Предыдущий snapshot:** [2026-05-06-state.md](./2026-05-06-state.md) (v0.9, prod hibernated) + +--- + +## 0. Что изменилось с v0.9 + +### Production stand-up на cluster.142 (Phase 1-5 done) + +**Phase 1 — Postgres prod stand-up:** +- Discovery: cluster.142 НЕ hibernated (state.md устарел — k8s API v1.33.7 жив, ordinis-prod ns с Helm rev 17 deployed 4 дня назад, всё scaled to 0) +- CNPG cluster `ordinis-postgres` healthy, 50Gi local-path PVC +- Custom image `postgis-barman:18.3-3.6.2-1` (PostGIS 18 + barman-cli-cloud) для CNPG backups — официальный `cnpg/postgis:18-standard-trixie` НЕ имеет barman tools +- barmanObjectStore → `s3://altum-backups/ordinis-postgres` через `geoportal-prod-minio:9000` (re-use bucket с prefix isolation) +- ScheduledBackup: daily 02:30 UTC + weekly Sun 04:00 UTC +- Initial backup landed, PITR window started + +**Phase 2 — Vault re-init:** +- Original Vault sealed после restart 17h, unseal key потерян +- Re-init с wipe `data-vault-0` PVC → init -key-shares=1 -key-threshold=1 +- Setup playbook: `kubernetes` auth, policy `ordinis-app`, 4 roles (per-SA binding) +- 6 secret paths populated из existing k8s secrets (CNPG postgres, Strimzi KafkaUsers, Redis) +- Scripts: `ordinis-infra/scripts/vault/{setup,populate}.sh` + README + +**Phase 3 — Kafka cluster recovery:** +- `ordinis-kafka` Strimzi cluster CR не было в namespace (только orphaned KafkaUsers + 1 service) +- Apply `ordinis-infra/k8s/kafka/cluster-prod.yaml` (KafkaNodePool dual + Kafka KRaft + 3 KafkaTopics) +- 1 broker, single-instance, SCRAM-SHA-512 auth, 20Gi local-path PVC +- Strimzi operator уже watches ordinis-prod (STRIMZI_NAMESPACE=kafka-test,ordinis-prod) +- Cluster Ready через 90s после apply + +**Phase 4 — App deploy:** +- `config-server`, `ordinis-redis-0` scaled up (были 0/0) +- Helm upgrade `ordinis` rev 17 → 22 на `image.tag=main-4252ad93` +- Replicas bumped: writer 1→2, readApi 1→2 (HA для consumer-facing) +- 9 pods Running, /actuator/health → 200, /api/v1/dictionaries → 200 + 40 dicts seeded + +**Phase 5 — Альтум cutover:** +- Blue/green phased shift через Альтум config (10% → 50% → 100%) +- staging-as-prod decommissioned для production traffic +- staging cluster.265 теперь чисто dev environment + +### Что закоммичено + +**ordinis-infra (4 commits сегодня):** +- `cluster-prod.yaml` aligned с geoportal pattern (local-path, internal MinIO, single-instance) — было overcomplicated с Longhorn/Yandex S3 +- `values-prod.yaml`: writer=2, readApi=2, host `ordinis.k8s.264.nstart.cloud`, `selfsigned-cluster-issuer` +- `prometheus-rules.yaml`: 4 CNPG HA alerts (conditional `cnpgHa.enabled` flag, off для single-instance) +- `k8s/kafka/cluster-prod.yaml` (NEW): Kafka CR + NodePool + 3 Topics для recovery +- `scripts/vault/{setup,populate}.sh + README.md` (NEW): playbook bootstrap + +**ordinis (8 commits сегодня — задеплоены в prod):** +- `c7a917d` test(webhook): unit-test WebhookTestPingService — 7 кейсов +- `ac93151` test(webhook): re-enable WebhookE2ETest через no-op scheduler + manual ticks +- `92507ab` feat(audit): URL persistence фильтров + chip-list активных +- `5941207` feat(records): bulk close — multi-select toolbar + per-record транзакция +- `640a633` test(records): unit-test BulkRecordService — 10 кейсов +- `66a4f13` test(geo): e2e auto-derive geometry из data.lat/lon — 6 кейсов +- `4252ad9` feat(records): bulk export CSV выбранных + pagination +- + 23 новых теста (7 webhook + 10 bulk + 6 e2e) + +--- + +## 1. Перечень требований + +### 1.1. Реализовано (production-ready, LIVE на prod cluster.142) + +Та же таблица что v0.9 + новые пункты: + +| # | Требование | Статус | +|----|---------------------------------------------------------------|--------| +| 1-32 | (см. v0.9, всё уже было ready) | ✅ | +| 33 | Production deployment на real cluster (cluster.142) | ✅ NEW | +| 34 | Bulk close записей с multi-select UI | ✅ NEW | +| 35 | Bulk CSV export выбранных записей | ✅ NEW | +| 36 | Audit log URL-persistent filters + chip-list | ✅ NEW | +| 37 | Pagination для records list (50/page client-side) | ✅ NEW | +| 38 | WebhookE2ETest stable на CI (no-op scheduler + manual ticks) | ✅ NEW | +| 39 | Auto-derive POINT geometry из data.lat/lon (3 пути backend + Liquibase backfill 0015) | ✅ | +| 40 | CNPG continuous WAL archive + scheduled backups в external S3 | ✅ NEW | + +### 1.2. В процессе / nice-to-have + +- KafkaTopics CR показывают `READY=False` (orphaned до Kafka cluster recreate, pending strimzi.io/managed sync) +- Vault SASL passwords могут быть stale если Strimzi user-operator regenerated после Kafka cluster recreate — re-run `scripts/vault/populate.sh` +- `postgis-barman:18.3-3.6.2-1` image сейчас pull от staging registry (`registry.k8s.265.nstart.local`) — для resilience mirror в prod registry `repo.nstart.cloud/terravault/postgis-barman` +- k6 benchmark на prod не прогнан (smoke 50 RPS / ramp 1k / sustain 5m готов в `k8s/benchmark/k6-job.yaml`) +- Real ЦУОД data integration (отдельный epic после prod soak) + +### 1.3. Roadmap (отложено) + +- **Approval workflow v2** (draft → review → publish) — design doc сохранён в `~/.gstack/projects/claude/zimin-main-design-approval-workflow-v2-20260507-121632.md`. Defer'нут до prod LIVE + observed compliance needs. Re-evaluate через 1-2 месяца после Альтум stable. +- **True HA Postgres** (3-instance + Longhorn + external Yandex S3) — отдельный future epic для multi-node cluster, не для cluster.142 +- Lineage / dependency graph между dictionaries +- Cross-dictionary FK с cascade rules +- Data quality rules engine +- Federation MDM-кластеров (master/replica) +- Schema registry (Apicurio/Confluent) для Kafka + +--- + +## 2. Архитектура (без изменений с v0.9, кроме prod) + +``` +┌─────────────────────┐ ┌──────────────────────┐ ┌─────────────┐ +│ Альтум (real users) │ ──→│ ordinis.k8s.264 │ ──→│ Postgres │ +│ │ │ (cluster.142 prod) │ │ (CNPG 1× │ +│ │ │ • read-api ×2 │ │ + WAL S3 │ +│ │ │ • app ×2 (writer) │ │ + daily │ +│ │ │ • projection-writer │ │ backups) │ +│ │ │ • admin-ui ×1 │ │ │ +│ │ │ • Kafka 1× + 3 topics │ │ +│ │ │ • Redis 1× │ │ │ +│ │ │ • Vault 1× │ │ │ +│ │ └──────────────────────┘ └─────────────┘ +└─────────────────────┘ + ┌──────────────────────┐ + │ staging cluster.265 │ + │ (DEV ENVIRONMENT) │ + └──────────────────────┘ +``` + +--- + +## 3. Operational notes + +**Backup verify:** `barman-cloud-backup-list --endpoint-url http://geoportal-prod-minio.geoportal-production:9000 --cloud-provider aws-s3 s3://altum-backups/ordinis-postgres ordinis-postgres` + +**Vault sealed после restart:** `kubectl exec -n vault vault-0 -- vault operator unseal ` (key хранится у operator'а в 1Password / GitLab vars). + +**Rollback план:** DNS TTL 60s — при критичных issues Альтум переключает обратно на staging через config flag. + +--- + +**Email:** zimin.an@nstart.space (НЕ gmail)