# k8s/base/namespace.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: microservices
  labels:
    name: microservices
    environment: development
    # Why these labels? They enable advanced features like network policies and resource quotas
    app.kubernetes.io/name: ecommerce-platform
    app.kubernetes.io/part-of: microservices-demo
---
# Optional: Resource quota to prevent resource exhaustion
apiVersion: v1
kind: ResourceQuota
metadata:
  name: microservices-quota
  namespace: microservices
spec:
  hard:
    requests.cpu: "4"      # Total CPU requests allowed
    requests.memory: 8Gi   # Total memory requests allowed
    limits.cpu: "8"        # Total CPU limits allowed
    limits.memory: 16Gi    # Total memory limits allowed
    pods: "20"             # Maximum number of pods
    services: "10"         # Maximum number of services
    persistentvolumeclaims: "5"  # Maximum PVCs

# k8s/base/postgres.yaml
# Why Secret? Keeps sensitive data separate from configuration
apiVersion: v1
kind: Secret
metadata:
  name: postgres-secret
  namespace: microservices
type: Opaque
data:
  # Why base64? Kubernetes Secrets use base64 encoding (not encryption!)
  # In production, use external secret management systems
  postgres-password: cGFzc3dvcmQ=  # "password"
  postgres-user: cG9zdGdyZXM=      # "postgres"
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: postgres-config
  namespace: microservices
data:
  POSTGRES_DB: ecommerce
  POSTGRES_USER: postgres
  # Why init script? Sets up database schema on first startup
  init.sql: |
    -- Create databases for each service
    CREATE DATABASE IF NOT EXISTS userdb;
    CREATE DATABASE IF NOT EXISTS productdb;
    CREATE DATABASE IF NOT EXISTS orderdb;
    
    -- Create users table
    \c userdb;
    CREATE TABLE IF NOT EXISTS users (
        id SERIAL PRIMARY KEY,
        email VARCHAR(255) UNIQUE NOT NULL,
        password_hash VARCHAR(255) NOT NULL,
        name VARCHAR(255) NOT NULL,
        created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
    );
    
    -- Create products table
    \c productdb;
    CREATE TABLE IF NOT EXISTS products (
        id SERIAL PRIMARY KEY,
        name VARCHAR(255) NOT NULL,
        description TEXT,
        price DECIMAL(10,2) NOT NULL,
        stock_quantity INTEGER DEFAULT 0,
        category VARCHAR(100),
        active BOOLEAN DEFAULT true,
        created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
    );
    
    -- Insert sample data
    INSERT INTO products (name, description, price, stock_quantity, category) VALUES
    ('Laptop', 'High-performance laptop', 1299.99, 10, 'Electronics'),
    ('Coffee Mug', 'Ceramic coffee mug', 12.99, 50, 'Kitchen'),
    ('Book', 'Programming guide', 39.99, 25, 'Books')
    ON CONFLICT DO NOTHING;
---
# Why PVC? Ensures data persists even if pods are rescheduled
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: postgres-pvc
  namespace: microservices
spec:
  accessModes:
    - ReadWriteOnce  # Why RWO? PostgreSQL doesn't support concurrent writes
  resources:
    requests:
      storage: 10Gi
  # storageClassName: fast-ssd  # Uncomment for specific storage class
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: postgres
  namespace: microservices
  labels:
    app: postgres
    app.kubernetes.io/name: postgresql
    app.kubernetes.io/component: database
spec:
  serviceName: postgres-service
  replicas: 1  # Why 1? PostgreSQL primary-replica setup requires special configuration
  selector:
    matchLabels:
      app: postgres
  template:
    metadata:
      labels:
        app: postgres
        app.kubernetes.io/name: postgresql
        app.kubernetes.io/component: database
    spec:
      containers:
      - name: postgres
        image: postgres:15-alpine  # Why alpine? Smaller image size, faster deployments
        env:
        - name: POSTGRES_DB
          valueFrom:
            configMapKeyRef:
              name: postgres-config
              key: POSTGRES_DB
        - name: POSTGRES_USER
          valueFrom:
            secretKeyRef:
              name: postgres-secret
              key: postgres-user
        - name: POSTGRES_PASSWORD
          valueFrom:
            secretKeyRef:
              name: postgres-secret
              key: postgres-password
        - name: PGDATA
          value: /var/lib/postgresql/data/pgdata
        ports:
        - containerPort: 5432
          name: postgresql
        volumeMounts:
        - name: postgres-storage
          mountPath: /var/lib/postgresql/data
        - name: postgres-config-volume
          mountPath: /docker-entrypoint-initdb.d
        # Why these probes? Ensure PostgreSQL is ready before accepting connections
        livenessProbe:
          exec:
            command:
              - pg_isready
              - -U
              - postgres
          initialDelaySeconds: 30
          periodSeconds: 10
        readinessProbe:
          exec:
            command:
              - pg_isready
              - -U
              - postgres
          initialDelaySeconds: 5
          periodSeconds: 5
        resources:
          requests:
            memory: "256Mi"
            cpu: "250m"
          limits:
            memory: "512Mi"
            cpu: "500m"
      volumes:
      - name: postgres-storage
        persistentVolumeClaim:
          claimName: postgres-pvc
      - name: postgres-config-volume
        configMap:
          name: postgres-config
---
# Why ClusterIP? Database should only be accessible within the cluster
apiVersion: v1
kind: Service
metadata:
  name: postgres-service
  namespace: microservices
  labels:
    app: postgres
    app.kubernetes.io/name: postgresql
    app.kubernetes.io/component: database
spec:
  selector:
    app: postgres
  ports:
  - port: 5432
    targetPort: 5432
    name: postgresql
  type: ClusterIP

# k8s/base/user-service.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: user-service
  namespace: microservices
  labels:
    app: user-service
    app.kubernetes.io/name: user-service
    app.kubernetes.io/component: backend
    app.kubernetes.io/part-of: ecommerce-platform
spec:
  replicas: 2  # Why 2? Minimum for high availability without over-provisioning
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1     # Why 1? Ensures at least one instance is always running
      maxSurge: 1          # Why 1? Limits resource usage during deployments
  selector:
    matchLabels:
      app: user-service
  template:
    metadata:
      labels:
        app: user-service
        version: v1  # Why version label? Enables advanced deployment strategies
    spec:
      # Why security context? Implements security best practices
      securityContext:
        runAsNonRoot: true
        runAsUser: 1001
        fsGroup: 1001
      containers:
      - name: user-service
        image: your-registry/user-service:latest  # Replace with your registry
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 3001
          name: http
          protocol: TCP
        env:
        - name: NODE_ENV
          value: production
        - name: PORT
          value: "3001"
        - name: DB_HOST
          value: postgres-service  # Why service name? Kubernetes DNS resolution
        - name: DB_NAME
          value: userdb
        - name: DB_USER
          valueFrom:
            secretKeyRef:
              name: postgres-secret
              key: postgres-user
        - name: DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: postgres-secret
              key: postgres-password
        - name: JWT_SECRET
          valueFrom:
            secretKeyRef:
              name: app-secrets
              key: jwt-secret
        # Why liveness probe? Kubernetes restarts unhealthy containers
        livenessProbe:
          httpGet:
            path: /health
            port: 3001
          initialDelaySeconds: 30  # Why 30s? Allows time for application startup
          periodSeconds: 10
          timeoutSeconds: 5
          failureThreshold: 3
        # Why readiness probe? Controls when pod receives traffic
        readinessProbe:
          httpGet:
            path: /ready
            port: 3001
          initialDelaySeconds: 5
          periodSeconds: 5
          timeoutSeconds: 3
          failureThreshold: 3
        # Why resource limits? Prevents resource contention and enables better scheduling
        resources:
          requests:
            memory: "128Mi"  # Minimum guaranteed memory
            cpu: "100m"      # Minimum guaranteed CPU (0.1 core)
          limits:
            memory: "256Mi"  # Maximum memory before OOMKill
            cpu: "200m"      # Maximum CPU usage
        # Why security context? Additional container-level security
        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true  # Prevents runtime file system modifications
          capabilities:
            drop:
              - ALL  # Drop all capabilities for security
        # Why volume mounts? Read-only root filesystem requires writable tmp
        volumeMounts:
        - name: tmp-volume
          mountPath: /tmp
        - name: var-run-volume
          mountPath: /var/run
      volumes:
      - name: tmp-volume
        emptyDir: {}
      - name: var-run-volume
        emptyDir: {}
      # Why restart policy? Ensures failed containers are restarted
      restartPolicy: Always
---
# Why separate service? Provides stable endpoint regardless of pod changes
apiVersion: v1
kind: Service
metadata:
  name: user-service
  namespace: microservices
  labels:
    app: user-service
    app.kubernetes.io/name: user-service
    app.kubernetes.io/component: backend
spec:
  selector:
    app: user-service
  ports:
  - port: 3001
    targetPort: 3001
    protocol: TCP
    name: http
  type: ClusterIP  # Why ClusterIP? Internal service, accessed via API gateway
---
# Application secrets
apiVersion: v1
kind: Secret
metadata:
  name: app-secrets
  namespace: microservices
type: Opaque
data:
  # Why strong JWT secret? Security of authentication tokens
  jwt-secret: bXktc2VjdXJlLWp3dC1rZXktd2l0aC1lbm91Z2gtZW50cm9weQ==  # base64 encoded secure key

# k8s/base/product-service.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: product-service
  namespace: microservices
  labels:
    app: product-service
    app.kubernetes.io/name: product-service
    app.kubernetes.io/component: backend
spec:
  replicas: 3  # Why 3? Higher traffic expected for product browsing
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
      maxSurge: 2  # Why 2? Allows faster scaling during high traffic
  selector:
    matchLabels:
      app: product-service
  template:
    metadata:
      labels:
        app: product-service
        version: v1
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1001
        fsGroup: 1001
      containers:
      - name: product-service
        image: your-registry/product-service:latest
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 3002
          name: http
          protocol: TCP
        env:
        - name: NODE_ENV
          value: production
        - name: PORT
          value: "3002"
        - name: DB_HOST
          value: postgres-service
        - name: DB_NAME
          value: productdb
        - name: REDIS_HOST
          value: redis-service  # Why Redis? Caching for better performance
        - name: DB_USER
          valueFrom:
            secretKeyRef:
              name: postgres-secret
              key: postgres-user
        - name: DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: postgres-secret
              key: postgres-password
        livenessProbe:
          httpGet:
            path: /health
            port: 3002
          initialDelaySeconds: 30
          periodSeconds: 10
          timeoutSeconds: 5
          failureThreshold: 3
        readinessProbe:
          httpGet:
            path: /health
            port: 3002
          initialDelaySeconds: 5
          periodSeconds: 5
          timeoutSeconds: 3
          failureThreshold: 3
        resources:
          requests:
            memory: "128Mi"
            cpu: "100m"
          limits:
            memory: "256Mi"
            cpu: "200m"
        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
          capabilities:
            drop:
              - ALL
        volumeMounts:
        - name: tmp-volume
          mountPath: /tmp
        - name: var-run-volume
          mountPath: /var/run
      volumes:
      - name: tmp-volume
        emptyDir: {}
      - name: var-run-volume
        emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
  name: product-service
  namespace: microservices
  labels:
    app: product-service
    app.kubernetes.io/name: product-service
    app.kubernetes.io/component: backend
spec:
  selector:
    app: product-service
  ports:
  - port: 3002
    targetPort: 3002
    protocol: TCP
    name: http
  type: ClusterIP

# k8s/base/redis.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: redis
  namespace: microservices
  labels:
    app: redis
    app.kubernetes.io/name: redis
    app.kubernetes.io/component: cache
spec:
  replicas: 1  # Why 1? Redis clustering requires special configuration
  selector:
    matchLabels:
      app: redis
  template:
    metadata:
      labels:
        app: redis
    spec:
      containers:
      - name: redis
        image: redis:7-alpine
        command:
          - redis-server
          - --appendonly yes  # Why? Enables persistence
          - --maxmemory 256mb
          - --maxmemory-policy allkeys-lru  # Why LRU? Good default for caching
        ports:
        - containerPort: 6379
          name: redis
        resources:
          requests:
            memory: "128Mi"
            cpu: "100m"
          limits:
            memory: "256Mi"
            cpu: "200m"
        volumeMounts:
        - name: redis-data
          mountPath: /data
      volumes:
      - name: redis-data
        emptyDir: {}  # Why emptyDir? For demo purposes; use PVC in production
---
apiVersion: v1
kind: Service
metadata:
  name: redis-service
  namespace: microservices
  labels:
    app: redis
spec:
  selector:
    app: redis
  ports:
  - port: 6379
    targetPort: 6379
    name: redis
  type: ClusterIP

# k8s/base/api-gateway.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-config
  namespace: microservices
data:
  nginx.conf: |
    # Why custom nginx.conf? Need specific routing rules for microservices
    events {
        worker_connections 1024;
    }
    
    http {
        # Why upstream blocks? Enable load balancing and health checks
        upstream user-service {
            server user-service:3001;
        }
        
        upstream product-service {
            server product-service:3002;
        }
        
        # Why custom log format? Better observability for microservices
        log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                       '$status $body_bytes_sent "$http_referer" '
                       '"$http_user_agent" "$http_x_forwarded_for" '
                       'upstream_addr=$upstream_addr '
                       'upstream_response_time=$upstream_response_time';
        
        access_log /var/log/nginx/access.log main;
        
        server {
            listen 80;
            
            # Why CORS headers? Enable frontend applications to call APIs
            add_header Access-Control-Allow-Origin *;
            add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS";
            add_header Access-Control-Allow-Headers "Authorization, Content-Type";
            
            # Handle preflight requests
            if ($request_method = 'OPTIONS') {
                return 204;
            }
            
            # Route user service requests
            location /api/users/ {
                proxy_pass http://user-service;
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;
                
                # Why timeouts? Prevent hanging requests
                proxy_connect_timeout 5s;
                proxy_send_timeout 10s;
                proxy_read_timeout 10s;
            }
            
            # Route product service requests
            location /api/products/ {
                proxy_pass http://product-service;
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;
                
                proxy_connect_timeout 5s;
                proxy_send_timeout 10s;
                proxy_read_timeout 10s;
            }
            
            # Health check endpoint
            location /health {
                return 200 "API Gateway is healthy\n";
                add_header Content-Type text/plain;
            }
            
            # Default location for unmatched requests
            location / {
                return 404 "Service not found";
                add_header Content-Type text/plain;
            }
        }
    }
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: api-gateway
  namespace: microservices
  labels:
    app: api-gateway
    app.kubernetes.io/name: nginx
    app.kubernetes.io/component: gateway
spec:
  replicas: 2  # Why 2? High availability for the entry point
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
      maxSurge: 1
  selector:
    matchLabels:
      app: api-gateway
  template:
    metadata:
      labels:
        app: api-gateway
        version: v1
    spec:
      containers:
      - name: nginx
        image: nginx:1.25-alpine
        ports:
        - containerPort: 80
          name: http
          protocol: TCP
        volumeMounts:
        - name: nginx-config
          mountPath: /etc/nginx/nginx.conf
          subPath: nginx.conf
        # Why health checks for gateway? Critical component needs monitoring
        livenessProbe:
          httpGet:
            path: /health
            port: 80
          initialDelaySeconds: 10
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /health
            port: 80
          initialDelaySeconds: 5
          periodSeconds: 5
        resources:
          requests:
            memory: "64Mi"
            cpu: "50m"
          limits:
            memory: "128Mi"
            cpu: "100m"
      volumes:
      - name: nginx-config
        configMap:
          name: nginx-config
---
apiVersion: v1
kind: Service
metadata:
  name: api-gateway
  namespace: microservices
  labels:
    app: api-gateway
    app.kubernetes.io/name: nginx
    app.kubernetes.io/component: gateway
spec:
  selector:
    app: api-gateway
  ports:
  - port: 80
    targetPort: 80
    protocol: TCP
    name: http
  type: LoadBalancer  # Why LoadBalancer? Need external access for clients

apiVersion: v1
kind: Service
metadata:
  name: internal-service
spec:
  type: ClusterIP  # Default, can be omitted
  selector:
    app: my-app
  ports:
  - port: 80
    targetPort: 8080

apiVersion: v1
kind: Service
metadata:
  name: nodeport-service
spec:
  type: NodePort
  selector:
    app: my-app
  ports:
  - port: 80
    targetPort: 8080
    nodePort: 30080  # Optional, will be assigned if not specified

apiVersion: v1
kind: Service
metadata:
  name: loadbalancer-service
spec:
  type: LoadBalancer
  selector:
    app: my-app
  ports:
  - port: 80
    targetPort: 8080

apiVersion: v1
kind: Service
metadata:
  name: headless-service
spec:
  clusterIP: None  # Makes it headless
  selector:
    app: database-cluster
  ports:
  - port: 5432

# Istio service entry for external service
apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: external-payment-service
spec:
  hosts:
  - payment-api.external.com
  ports:
  - number: 443
    name: https
    protocol: HTTPS
  location: MESH_EXTERNAL
  resolution: DNS
---
# Virtual service for traffic routing
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: user-service-routing
spec:
  hosts:
  - user-service
  http:
  - match:
    - headers:
        version:
          exact: v2
    route:
    - destination:
        host: user-service
        subset: v2
  - route:
    - destination:
        host: user-service
        subset: v1

apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
  namespace: microservices
data:
  # Simple key-value pairs
  database.host: "postgres-service"
  database.port: "5432"
  redis.ttl: "3600"
  
  # Configuration files
  app.properties: |
    spring.datasource.url=jdbc:postgresql://postgres-service:5432/ecommerce
    spring.jpa.hibernate.ddl-auto=update
    logging.level.root=INFO
    
  nginx.conf: |
    upstream backend {
        server product-service:3002;
        server user-service:3001 backup;
    }

apiVersion: v1
kind: Secret
metadata:
  name: database-credentials
  namespace: microservices
type: Opaque
data:
  username: cG9zdGdyZXM=  # postgres
  password: c2VjdXJlUGFzcw==  # securePass
---
# TLS secret for HTTPS
apiVersion: v1
kind: Secret
metadata:
  name: tls-secret
  namespace: microservices
type: kubernetes.io/tls
data:
  tls.crt: LS0tLS1CRUdJTi... # base64 encoded certificate
  tls.key: LS0tLS1CRUdJTi... # base64 encoded private key

apiVersion: apps/v1
kind: Deployment
metadata:
  name: configurable-service
spec:
  template:
    spec:
      containers:
      - name: app
        image: my-app:latest
        env:
        # Single values from ConfigMap
        - name: DATABASE_HOST
          valueFrom:
            configMapKeyRef:
              name: app-config
              key: database.host
        
        # Single values from Secret
        - name: DATABASE_PASSWORD
          valueFrom:
            secretKeyRef:
              name: database-credentials
              key: password
        
        # All ConfigMap keys as environment variables
        envFrom:
        - configMapRef:
            name: app-config
        - secretRef:
            name: database-credentials
        
        volumeMounts:
        # Mount ConfigMap as files
        - name: config-volume
          mountPath: /etc/config
        # Mount Secret as files
        - name: secret-volume
          mountPath: /etc/secrets
          readOnly: true
      
      volumes:
      - name: config-volume
        configMap:
          name: app-config
      - name: secret-volume
        secret:
          secretName: database-credentials
          defaultMode: 0400  # Read-only for owner

# k8s/base/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

resources:
- namespace.yaml
- postgres.yaml
- user-service.yaml
- product-service.yaml
- api-gateway.yaml

commonLabels:
  app.kubernetes.io/version: v1.0.0
  app.kubernetes.io/managed-by: kustomize

# k8s/overlays/production/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

namePrefix: prod-
namespace: microservices-prod

resources:
- ../../base

patchesStrategicMerge:
- replica-count.yaml
- resource-limits.yaml

configMapGenerator:
- name: app-config
  literals:
  - database.host=prod-postgres-service
  - log.level=ERROR

secretGenerator:
- name: database-credentials
  literals:
  - username=produser
  - password=prodpassword

images:
- name: your-registry/user-service
  newTag: v1.2.3
- name: your-registry/product-service
  newTag: v1.2.3

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: fast-ssd
provisioner: kubernetes.io/aws-ebs  # AWS EBS
parameters:
  type: gp3
  iops: "3000"
  throughput: "125"
allowVolumeExpansion: true
reclaimPolicy: Delete
volumeBindingMode: WaitForFirstConsumer
---
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: slow-hdd
provisioner: kubernetes.io/aws-ebs
parameters:
  type: sc1
allowVolumeExpansion: true
reclaimPolicy: Retain
volumeBindingMode: Immediate

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: database-storage
  namespace: microservices
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: fast-ssd
  resources:
    requests:
      storage: 50Gi
---
# For shared storage (NFS, etc.)
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: shared-storage
  namespace: microservices
spec:
  accessModes:
    - ReadWriteMany
  storageClassName: nfs-storage
  resources:
    requests:
      storage: 100Gi

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: redis-cluster
  namespace: microservices
spec:
  serviceName: redis-cluster
  replicas: 3
  selector:
    matchLabels:
      app: redis-cluster
  template:
    metadata:
      labels:
        app: redis-cluster
    spec:
      containers:
      - name: redis
        image: redis:6.2-alpine
        ports:
        - containerPort: 6379
        - containerPort: 16379
        command:
        - redis-server
        - /conf/redis.conf
        volumeMounts:
        - name: redis-data
          mountPath: /data
        - name: redis-config
          mountPath: /conf
        resources:
          requests:
            memory: "256Mi"
            cpu: "250m"
          limits:
            memory: "512Mi"
            cpu: "500m"
      volumes:
      - name: redis-config
        configMap:
          name: redis-config
  volumeClaimTemplates:
  - metadata:
      name: redis-data
    spec:
      accessModes: ["ReadWriteOnce"]
      storageClassName: fast-ssd
      resources:
        requests:
          storage: 10Gi

apiVersion: batch/v1
kind: CronJob
metadata:
  name: postgres-backup
  namespace: microservices
spec:
  schedule: "0 2 * * *"  # Daily at 2 AM
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: backup
            image: postgres:13
            command:
            - sh
            - -c
            - |
              TIMESTAMP=$(date +%Y%m%d_%H%M%S)
              pg_dump -h postgres-service -U postgres -d ecommerce > /backup/backup_$TIMESTAMP.sql
              # Upload to S3 or other storage
              aws s3 cp /backup/backup_$TIMESTAMP.sql s3://backup-bucket/postgres/
              # Clean up old local backups
              find /backup -name "backup_*.sql" -mtime +7 -delete
            env:
            - name: PGPASSWORD
              valueFrom:
                secretKeyRef:
                  name: postgres-secret
                  key: postgres-password
            volumeMounts:
            - name: backup-storage
              mountPath: /backup
          volumes:
          - name: backup-storage
            persistentVolumeClaim:
              claimName: backup-pvc
          restartPolicy: OnFailure

# monitoring-values.yaml
prometheus:
  prometheusSpec:
    retention: 30d
    storageSpec:
      volumeClaimTemplate:
        spec:
          storageClassName: fast-ssd
          accessModes: ["ReadWriteOnce"]
          resources:
            requests:
              storage: 50Gi

grafana:
  adminPassword: admin123
  persistence:
    enabled: true
    storageClassName: fast-ssd
    size: 10Gi

alertmanager:
  alertmanagerSpec:
    storage:
      volumeClaimTemplate:
        spec:
          storageClassName: fast-ssd
          accessModes: ["ReadWriteOnce"]
          resources:
            requests:
              storage: 10Gi

apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: microservices-monitor
  namespace: monitoring
  labels:
    release: monitoring  # Must match Prometheus selector
spec:
  selector:
    matchLabels:
      monitoring: enabled
  endpoints:
  - port: http
    path: /metrics
    interval: 30s
  namespaceSelector:
    matchNames:
    - microservices

apiVersion: v1
kind: Service
metadata:
  name: user-service
  namespace: microservices
  labels:
    app: user-service
    monitoring: enabled  # Required for ServiceMonitor
spec:
  selector:
    app: user-service
  ports:
  - name: http
    port: 3001
    targetPort: 3001

# elasticsearch.yaml
apiVersion: elasticsearch.k8s.elastic.co/v1
kind: Elasticsearch
metadata:
  name: elasticsearch
  namespace: logging
spec:
  version: 7.15.0
  nodeSets:
  - name: default
    count: 3
    config:
      node.store.allow_mmap: false
    podTemplate:
      spec:
        containers:
        - name: elasticsearch
          resources:
            requests:
              memory: 2Gi
              cpu: 1
            limits:
              memory: 4Gi
              cpu: 2
    volumeClaimTemplates:
    - metadata:
        name: elasticsearch-data
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: 100Gi
        storageClassName: fast-ssd
---
# kibana.yaml
apiVersion: kibana.k8s.elastic.co/v1
kind: Kibana
metadata:
  name: kibana
  namespace: logging
spec:
  version: 7.15.0
  count: 1
  elasticsearchRef:
    name: elasticsearch
  http:
    service:
      spec:
        type: LoadBalancer

# fluent-bit-config.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: fluent-bit-config
  namespace: logging
data:
  fluent-bit.conf: |
    [SERVICE]
        Flush         1
        Log_Level     info
        Daemon        off
        Parsers_File  parsers.conf
        HTTP_Server   On
        HTTP_Listen   0.0.0.0
        HTTP_Port     2020
        
    [INPUT]
        Name              tail
        Path              /var/log/containers/*.log
        Parser            docker
        Tag               kube.*
        Refresh_Interval  5
        Mem_Buf_Limit     50MB
        Skip_Long_Lines   On
        
    [FILTER]
        Name                kubernetes
        Match               kube.*
        Kube_URL            https://kubernetes.default.svc:443
        Kube_CA_File        /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        Kube_Token_File     /var/run/secrets/kubernetes.io/serviceaccount/token
        Kube_Tag_Prefix     kube.var.log.containers.
        Merge_Log           On
        K8S-Logging.Parser  On
        K8S-Logging.Exclude Off
        
    [OUTPUT]
        Name            es
        Match           kube.*
        Host            elasticsearch-es-http.logging
        Port            9200
        HTTP_User       elastic
        HTTP_Passwd     ${ELASTICSEARCH_PASSWORD}
        Index           kubernetes-logs
        Type            _doc
        
  parsers.conf: |
    [PARSER]
        Name        docker
        Format      json
        Time_Key    time
        Time_Format %Y-%m-%dT%H:%M:%S.%L
        Time_Keep   On

# blue-green-deployment.yaml
apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: user-service-rollout
  namespace: microservices
spec:
  replicas: 5
  strategy:
    blueGreen:
      activeService: user-service-active
      previewService: user-service-preview
      autoPromotionEnabled: false
      scaleDownDelaySeconds: 30
      prePromotionAnalysis:
        templates:
        - templateName: success-rate
        args:
        - name: service-name
          value: user-service-preview
      postPromotionAnalysis:
        templates:
        - templateName: success-rate
        args:
        - name: service-name
          value: user-service-active
  selector:
    matchLabels:
      app: user-service
  template:
    metadata:
      labels:
        app: user-service
    spec:
      containers:
      - name: user-service
        image: your-registry/user-service:latest
        ports:
        - containerPort: 3001
        resources:
          requests:
            memory: "256Mi"
            cpu: "200m"
          limits:
            memory: "512Mi"
            cpu: "400m"
---
apiVersion: v1
kind: Service
metadata:
  name: user-service-active
  namespace: microservices
spec:
  selector:
    app: user-service
  ports:
  - port: 3001
    targetPort: 3001
---
apiVersion: v1
kind: Service
metadata:
  name: user-service-preview
  namespace: microservices
spec:
  selector:
    app: user-service
  ports:
  - port: 3001
    targetPort: 3001

apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: product-service-rollout
  namespace: microservices
spec:
  replicas: 10
  strategy:
    canary:
      steps:
      - setWeight: 20
      - pause: {}
      - setWeight: 40
      - pause: {duration: 10}
      - setWeight: 60
      - pause: {duration: 10}
      - setWeight: 80
      - pause: {duration: 10}
      canaryService: product-service-canary
      stableService: product-service-stable
      trafficRouting:
        istio:
          virtualService:
            name: product-service-vs
            routes:
            - primary
  selector:
    matchLabels:
      app: product-service
  template:
    metadata:
      labels:
        app: product-service
    spec:
      containers:
      - name: product-service
        image: your-registry/product-service:latest
        ports:
        - containerPort: 3002

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: user-service-hpa
  namespace: microservices
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: user-service
  minReplicas: 2
  maxReplicas: 20
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70
  - type: Resource
    resource:
      name: memory
      target:
        type: Utilization
        averageUtilization: 80
  - type: Pods
    pods:
      metric:
        name: http_requests_per_second
      target:
        type: AverageValue
        averageValue: "100"
  behavior:
    scaleDown:
      stabilizationWindowSeconds: 300
      policies:
      - type: Percent
        value: 10
        periodSeconds: 60
    scaleUp:
      stabilizationWindowSeconds: 0
      policies:
      - type: Percent
        value: 100
        periodSeconds: 15
      - type: Pods
        value: 4
        periodSeconds: 15
      selectPolicy: Max

apiVersion: autoscaling.k8s.io/v1
kind: VerticalPodAutoscaler
metadata:
  name: product-service-vpa
  namespace: microservices
spec:
  targetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: product-service
  updatePolicy:
    updateMode: "Auto"
  resourcePolicy:
    containerPolicies:
    - containerName: product-service
      minAllowed:
        cpu: 100m
        memory: 128Mi
      maxAllowed:
        cpu: 1
        memory: 1Gi
      controlledResources: ["cpu", "memory"]

# cluster-1-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: user-service
  namespace: microservices
  labels:
    cluster: us-east-1
spec:
  replicas: 3
  selector:
    matchLabels:
      app: user-service
  template:
    metadata:
      labels:
        app: user-service
        cluster: us-east-1
    spec:
      containers:
      - name: user-service
        image: your-registry/user-service:v1.2.3
        env:
        - name: CLUSTER_REGION
          value: "us-east-1"
        - name: DATABASE_REPLICA
          value: "read-replica-east"
---
# cluster-2-deployment.yaml  
apiVersion: apps/v1
kind: Deployment
metadata:
  name: user-service
  namespace: microservices
  labels:
    cluster: us-west-2
spec:
  replicas: 3
  selector:
    matchLabels:
      app: user-service
  template:
    metadata:
      labels:
        app: user-service
        cluster: us-west-2
    spec:
      containers:
      - name: user-service
        image: your-registry/user-service:v1.2.3
        env:
        - name: CLUSTER_REGION
          value: "us-west-2"
        - name: DATABASE_REPLICA
          value: "read-replica-west"

apiVersion: v1
kind: Namespace
metadata:
  name: microservices
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted

apiVersion: apps/v1
kind: Deployment
metadata:
  name: secure-service
spec:
  template:
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 3000
        fsGroup: 2000
        seccompProfile:
          type: RuntimeDefault
      containers:
      - name: app
        image: your-app:latest
        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          runAsUser: 1000
        volumeMounts:
        - name: tmp
          mountPath: /tmp
        - name: var-run
          mountPath: /var/run
      volumes:
      - name: tmp
        emptyDir: {}
      - name: var-run
        emptyDir: {}

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: microservices-network-policy
  namespace: microservices
spec:
  podSelector:
    matchLabels:
      app: user-service
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: api-gateway
    - namespaceSelector:
        matchLabels:
          name: monitoring
      podSelector:
        matchLabels:
          app: prometheus
    ports:
    - protocol: TCP
      port: 3001
  egress:
  - to:
    - podSelector:
        matchLabels:
          app: postgres
    ports:
    - protocol: TCP
      port: 5432
  - to: []  # Allow DNS
    ports:
    - protocol: UDP
      port: 53

apiVersion: v1
kind: ServiceAccount
metadata:
  name: microservice-sa
  namespace: microservices
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: microservices
  name: microservice-role
rules:
- apiGroups: [""]
  resources: ["secrets", "configmaps"]
  verbs: ["get", "list"]
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: microservice-rolebinding
  namespace: microservices
subjects:
- kind: ServiceAccount
  name: microservice-sa
  namespace: microservices
roleRef:
  kind: Role
  name: microservice-role
  apiGroup: rbac.authorization.k8s.io
---
# Use in deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: user-service
spec:
  template:
    spec:
      serviceAccountName: microservice-sa
      containers:
      - name: user-service
        image: your-registry/user-service:latest