# backend.tf
terraform {
  backend "s3" {
    bucket         = "my-terraform-state-bucket"
    key            = "infrastructure/prod/terraform.tfstate"
    region         = "us-east-1"
    dynamodb_table = "terraform-locks"
    encrypt        = true
  }
}

# Workspace approach (for ephemeral envs)
terraform workspace new feature-branch-xyz
terraform workspace select feature-branch-xyz
terraform apply

# Use workspace name in resource naming
module "eks" {
  name_prefix = "app-${terraform.workspace}"
  # ...
}

# modules/eks/main.tf
variable "cluster_name" {
  type        = string
  description = "Name of the EKS cluster"
}

variable "node_count" {
  type        = number
  description = "Number of worker nodes"
  default     = 3
}

variable "instance_type" {
  type        = string
  default     = "t3.medium"
}

output "cluster_endpoint" {
  value       = aws_eks_cluster.main.endpoint
  description = "EKS cluster API endpoint"
}

output "cluster_security_group_id" {
  value       = aws_eks_cluster.main.vpc_config[0].cluster_security_group_id
  description = "Security group ID for the cluster"
}

# .github/workflows/terraform.yml
name: Terraform

on:
  push:
    branches: [main]
    paths: ['infrastructure/**']
  pull_request:
    branches: [main]
    paths: ['infrastructure/**']

env:
  TF_WORKSPACE: ${{ github.ref == 'refs/heads/main' && 'prod' || 'dev' }}

jobs:
  terraform:
    name: Terraform
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: infrastructure/environments/${{ env.TF_WORKSPACE }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3
        with:
          terraform_version: 1.9.0

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: us-east-1

      - name: Terraform Init
        run: terraform init

      - name: Terraform Format Check
        run: terraform fmt -check -recursive

      - name: Terraform Validate
        run: terraform validate

      - name: Terraform Plan
        if: github.event_name == 'pull_request'
        run: terraform plan -input=false -out=tfplan
        env:
          TF_VAR_environment: ${{ env.TF_WORKSPACE }}

      - name: Post Plan as PR Comment
        if: github.event_name == 'pull_request'
        uses: actions/github-script@v7
        with:
          script: |
            const plan = require('fs').readFileSync('tfplan', 'utf8');
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: '```\\n' + plan + '\\n```'
            });

      - name: Terraform Apply
        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
        run: terraform apply -auto-approve tfplan
        env:
          TF_VAR_environment: ${{ env.TF_WORKSPACE }}

# Cluster info & context
kubectl config get-contexts
kubectl config use-context my-cluster
kubectl cluster-info

# Workload management
kubectl get pods -n <namespace>
kubectl get deployments -n <namespace>
kubectl get services -n <namespace>
kubectl get ingress -n <namespace>

# Debugging
kubectl logs -f <pod-name> -n <namespace>
kubectl logs -f <pod-name> -c <container-name> -n <namespace>
kubectl describe pod <pod-name> -n <namespace>
kubectl exec -it <pod-name> -n <namespace> -- /bin/sh

# Resource management
kubectl apply -f deployment.yaml
kubectl delete -f deployment.yaml
kubectl rollout status deployment/<name> -n <namespace>
kubectl rollout undo deployment/<name> -n <namespace>

# Dry-run for validation
kubectl apply -f deployment.yaml --dry-run=client -o yaml
kubectl create deployment my-app --image=myapp:latest --dry-run=server -o yaml > deployment.yaml

# Add repository
helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
helm repo update

# Install with custom values
helm upgrade --install monitoring prometheus-community/kube-prometheus-stack \
  --namespace monitoring --create-namespace \
  -f values-prod.yaml \
  --timeout 10m --wait

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: my-app
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/org/k8s-manifests.git
    targetRevision: main
    path: apps/my-app/overlays/prod
  destination:
    server: https://kubernetes.default.svc
    namespace: my-app
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
      - PrunePropagationPolicy=foreground

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
  namespace: my-app
  labels:
    app: my-app
    version: v1.2.3
spec:
  replicas: 3
  selector:
    matchLabels:
      app: my-app
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  template:
    metadata:
      labels:
        app: my-app
        version: v1.2.3
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "8080"
        prometheus.io/path: "/metrics"
    spec:
      serviceAccountName: my-app-sa
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        fsGroup: 2000
      containers:
        - name: my-app
          image: myregistry/my-app:v1.2.3
          ports:
            - containerPort: 8080
              protocol: TCP
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 500m
              memory: 512Mi
          readinessProbe:
            httpGet:
              path: /healthz
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8080
            initialDelaySeconds: 15
            periodSeconds: 20
          envFrom:
            - configMapRef:
                name: my-app-config
            - secretRef:
                name: my-app-secrets

# Install Cilium via Helm
helm repo add cilium https://helm.cilium.io/
helm install cilium cilium/cilium --namespace kube-system

# Create a vCluster
vcluster create my-vcluster -n namespace

# playbooks/site.yml
---
# Apply common configuration to all hosts
- hosts: all
  become: true
  roles:
    - common
    - security

# Configure Kubernetes masters
- hosts: k8s-masters
  become: true
  roles:
    - docker
    - kubernetes-master

# Configure Kubernetes workers
- hosts: k8s-workers
  become: true
  roles:
    - docker
    - kubernetes-worker

# Deploy monitoring agents
- hosts: k8s-all
  become: true
  roles:
    - node-exporter
    - promtail

# roles/node-exporter/tasks/main.yml
---
- name: Install node_exporter
  ansible.builtin.apt:
    name: prometheus-node-exporter
    state: present
    update_cache: true

- name: Ensure node_exporter is running
  ansible.builtin.service:
    name: node_exporter
    state: started
    enabled: true

- name: Configure firewall for node_exporter
  ansible.builtin.ufw:
    rule: allow
    port: "9100"
    proto: tcp

# .github/workflows/ansible.yml
name: Ansible

on:
  push:
    paths: ['ansible/**']
  pull_request:
    paths: ['ansible/**']

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Lint Ansible Playbooks
        uses: ansible/ansible-lint@v26
        with:
          args: ansible/playbooks/

  test:
    runs-on: ubuntu-latest
    needs: lint
    steps:
      - uses: actions/checkout@v4

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Install Ansible
        run: pip install ansible

      - name: Syntax Check
        run: ansible-playbook --syntax-check -i ansible/inventory/staging/hosts.yml ansible/playbooks/site.yml

      - name: Dry Run
        run: ansible-playbook --check -i ansible/inventory/staging/hosts.yml ansible/playbooks/site.yml

# Terraform triggers Ansible after provisioning
resource "null_resource" "ansible_provision" {
  triggers = {
    instance_ids = join(",", aws_instance.k8s[*].id)
  }

  provisioner "local-exec" {
    command = <<-EOT
      ANSIBLE_HOST_KEY_CHECKING=False \
      ansible-playbook \
        -i '${join("\n", aws_instance.k8s[*].public_ip)},' \
        --private-key ${var.ssh_private_key_path} \
        -u ubuntu \
        ansible/playbooks/site.yml
    EOT
  }

  depends_on = [aws_instance.k8s]
}

# Install kube-prometheus-stack (bundles Prometheus, Grafana, Alertmanager)
helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
helm repo update

helm upgrade --install monitoring prometheus-community/kube-prometheus-stack \
  --namespace monitoring --create-namespace \
  -f kube-prometheus-values.yaml

# kube-prometheus-values.yaml
prometheus:
  prometheusSpec:
    retention: 15d
    resources:
      requests:
        memory: 2Gi
        cpu: 500m
      limits:
        memory: 4Gi
        cpu: 2000m
    serviceMonitorSelectorNilUsesHelmValues: false
    podMonitorSelectorNilUsesHelmValues: false

grafana:
  enabled: true
  adminPassword: ${GRAFANA_ADMIN_PASSWORD}
  sidecar:
    dashboards:
      enabled: true
      label: grafana_dashboard
    datasources:
      enabled: true
  dashboardProviders:
    dashboardproviders.yaml:
      apiVersion: 1
      providers:
        - name: 'default'
          orgId: 1
          folder: ''
          type: file
          disableDeletion: false
          editable: true
          options:
            path: /var/lib/grafana/dashboards/default

alertmanager:
  config:
    global:
      resolve_timeout: 5m
      slack_api_url: '${SLACK_WEBHOOK_URL}'
    route:
      group_by: ['alertname', 'namespace']
      group_wait: 30s
      group_interval: 5m
      repeat_interval: 4h
      receiver: 'slack-notifications'
      routes:
        - match:
            severity: critical
          receiver: 'pagerduty-critical'
        - match:
            severity: warning
          receiver: 'slack-notifications'
    receivers:
      - name: 'slack-notifications'
        slack_configs:
          - channel: '#alerts'
            send_resolved: true
            title: '{{ .GroupLabels.alertname }}'
            text: '{{ range .Alerts }}{{ .Annotations.summary }}{{ end }}'
      - name: 'pagerduty-critical'
        pagerduty_configs:
          - service_key: '${PAGERDUTY_SERVICE_KEY}'

apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: my-app-monitor
  namespace: monitoring
  labels:
    release: monitoring
spec:
  selector:
    matchLabels:
      app: my-app
  endpoints:
    - port: http
      path: /metrics
      interval: 15s
  namespaceSelector:
    matchNames:
      - my-app

apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: my-app-alerts
  namespace: monitoring
  labels:
    release: monitoring
spec:
  groups:
    - name: my-app.rules
      rules:
        - alert: HighErrorRate
          expr: |
            sum(rate(http_requests_total{job="my-app",status=~"5.."}[5m]))
            /
            sum(rate(http_requests_total{job="my-app"}[5m]))
            > 0.05
          for: 5m
          labels:
            severity: critical
          annotations:
            summary: "High error rate on {{ $labels.instance }}"
            description: "Error rate is {{ $value | humanizePercentage }} (threshold: 5%)"

        - alert: HighMemoryUsage
          expr: |
            container_memory_usage_bytes{namespace="my-app"}
            /
            container_spec_memory_limit_bytes{namespace="my-app"}
            > 0.9
          for: 10m
          labels:
            severity: warning
          annotations:
            summary: "High memory usage in {{ $labels.pod }}"
            description: "Memory usage is {{ $value | humanizePercentage }} of limit"

        - alert: PodCrashLooping
          expr: |
            rate(kube_pod_container_status_restarts_total{namespace="my-app"}[15m])
            > 0
          for: 15m
          labels:
            severity: warning
          annotations:
            summary: "Pod {{ $labels.pod }} is crash looping"

# loki-values.yaml
loki:
  commonConfig:
    replication_factor: 1
  storage:
    type: filesystem
  schemaConfig:
    configs:
      - from: "2024-01-01"
        store: tsdb
        object_store: filesystem
        schema: v13
        index:
          prefix: loki_index_
          period: 24h

promtail:
  enabled: true
  config:
    clients:
      - url: http://loki:3100/loki/api/v1/push

// alloy-config.alloy
discovery.kubernetes "pods" {
  role = "pod"
}

discovery.relabel "kubernetes_pods" {
  targets = discovery.kubernetes.pods.targets

  rule {
    source_labels = ["__meta_kubernetes_namespace"]
    target_label  = "namespace"
  }

  rule {
    source_labels = ["__meta_kubernetes_pod_name"]
    target_label  = "pod"
  }

  rule {
    source_labels = ["__meta_kubernetes_pod_container_name"]
    target_label  = "container"
  }
}

loki.source.kubernetes "pods" {
  targets    = discovery.relabel.kubernetes_pods.output
  forward_to = [loki.write.loki.receiver]
}

loki.write "loki" {
  endpoint {
    url = "http://loki:3100/loki/api/v1/push"
  }
}

# Install ECK Operator
helm repo add elastic https://helm.elastic.co
helm repo update

helm install eck-operator elastic/eck-operator \
  --namespace elastic-system --create-namespace

# Deploy Elasticsearch + Kibana + Logstash
helm install eck-stack elastic/eck-stack \
  --namespace elastic-stack --create-namespace \
  -f eck-values.yaml

# eck-values.yaml
elasticsearch:
  nodeSets:
    - name: default
      count: 3
      config:
        node.store.allow_mmap: false
      podTemplate:
        spec:
          containers:
            - name: elasticsearch
              resources:
                requests:
                  memory: 2Gi
                  cpu: 500m
                limits:
                  memory: 4Gi
                  cpu: 2000m

kibana:
  count: 1
  config:
    server.publicBaseUrl: "https://kibana.example.com"

logstash:
  pipelines:
    - pipeline.id: k8s-logs
      config.string: |
        input {
          beats {
            port => 5044
          }
        }
        filter {
          if [kubernetes] {
            mutate {
              add_field => {
                "container_name" => "%{[kubernetes][container][name]}"
                "namespace" => "%{[kubernetes][namespace]}"
              }
            }
          }
        }
        output {
          elasticsearch {
            hosts => ["https://elasticsearch-es-http:9200"]
            user => "elastic"
            password => "${ELASTIC_PASSWORD}"
            ssl_certificate_authorities => ["/usr/share/logstash/config/certs/ca.crt"]
          }
        }

apiVersion: v1
kind: ConfigMap
metadata:
  name: my-app-dashboard
  namespace: monitoring
  labels:
    grafana_dashboard: "1"
data:
  my-app-dashboard.json: |
    {
      "annotations": {"list": []},
      "editable": true,
      "fiscalYearStartMonth": 0,
      "graphTooltip": 0,
      "id": null,
      "links": [],
      "panels": [
        {
          "datasource": {"type": "prometheus", "uid": "prometheus"},
          "fieldConfig": {"defaults": {"color": {"mode": "palette-classic"}}},
          "gridPos": {"h": 8, "w": 12, "x": 0, "y": 0},
          "id": 1,
          "targets": [
            {
              "expr": "sum(rate(http_requests_total{namespace=\"my-app\"}[5m]))",
              "legendFormat": "Requests/sec"
            }
          ],
          "title": "Request Rate",
          "type": "timeseries"
        },
        {
          "datasource": {"type": "loki", "uid": "loki"},
          "gridPos": {"h": 8, "w": 12, "x": 12, "y": 0},
          "id": 2,
          "targets": [
            {
              "expr": "{namespace=\"my-app\"} |= \"error\"",
              "refId": "A"
            }
          ],
          "title": "Error Logs",
          "type": "logs"
        }
      ],
      "schemaVersion": 39,
      "tags": ["my-app", "production"],
      "title": "My App Dashboard",
      "uid": "my-app-dashboard"
    }

# .github/workflows/ci-cd.yml
name: CI/CD Pipeline

on:
  push:
    branches: [main, 'release/**']
  pull_request:
    branches: [main]

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  # === PHASE 1: Build & Test ===
  build-and-test:
    runs-on: ubuntu-latest
    outputs:
      image-tag: ${{ steps.meta.outputs.tags }}
    steps:
      - uses: actions/checkout@v4

      - name: Run unit tests
        run: make test

      - name: Run SAST scan
        uses: securecodewarrior/github-action-scw-sast@v1
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=sha,prefix=
            type=ref,event=branch
            type=semver,pattern={{version}}

      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Run DAST scan
        run: |
          docker run -d --name app -p 8080:8080 ${{ steps.meta.outputs.tags }}
          sleep 10
          # Run OWASP ZAP or similar
          docker stop app && docker rm app

  # === PHASE 2: Infrastructure (if changed) ===
  terraform:
    needs: build-and-test
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: infrastructure/environments/prod

    steps:
      - uses: actions/checkout@v4

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v3

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: us-east-1

      - name: Terraform Init
        run: terraform init

      - name: Terraform Plan
        run: terraform plan -input=false -out=tfplan

      - name: Terraform Apply
        run: terraform apply -auto-approve tfplan

  # === PHASE 3: GitOps Update ===
  update-gitops:
    needs: [build-and-test, terraform]
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          repository: org/k8s-manifests
          token: ${{ secrets.GITOPS_PAT }}
          path: k8s-manifests

      - name: Update image tag
        run: |
          IMAGE_TAG="${{ needs.build-and-test.outputs.image-tag }}"
          cd k8s-manifests/apps/my-app/overlays/prod
          kustomize edit set image my-app=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG}

      - name: Commit and push
        run: |
          cd k8s-manifests
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add .
          git commit -m "Update my-app image to ${{ needs.build-and-test.outputs.image-tag }}"
          git push

# .gitlab-ci.yml
stages:
  - test
  - build
  - plan
  - apply
  - deploy

variables:
  IMAGE_TAG: $CI_COMMIT_SHA

test:
  stage: test
  script:
    - make test
    - make lint

build:
  stage: build
  script:
    - docker build -t $CI_REGISTRY_IMAGE:$IMAGE_TAG .
    - docker push $CI_REGISTRY_IMAGE:$IMAGE_TAG

terraform-plan:
  stage: plan
  script:
    - cd infrastructure/environments/$CI_ENVIRONMENT_NAME
    - terraform init
    - terraform plan -out=tfplan
  artifacts:
    paths:
      - infrastructure/environments/*/tfplan
  when: manual

terraform-apply:
  stage: apply
  script:
    - cd infrastructure/environments/$CI_ENVIRONMENT_NAME
    - terraform apply tfplan
  when: manual
  needs: ["terraform-plan"]

deploy:
  stage: deploy
  script:
    - kubectl set image deployment/my-app my-app=$CI_REGISTRY_IMAGE:$IMAGE_TAG -n my-app
  environment:
    name: production

apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: vault-backend
  namespace: default
spec:
  provider:
    vault:
      server: "https://vault.vault.svc.cluster.local:8200"
      path: "secret"
      version: "v2"
      auth:
        kubernetes:
          mountPath: "kubernetes"
          role: "my-app-role"
          serviceAccountRef:
            name: my-app-sa

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: my-app-secrets
  namespace: default
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vault-backend
    kind: SecretStore
  target:
    name: my-app-secrets
    creationPolicy: Owner
  data:
    - secretKey: DATABASE_URL
      remoteRef:
        key: my-app/database
        property: connection_string
    - secretKey: API_KEY
      remoteRef:
        key: my-app/api
        property: key

# Minimal RBAC for application service account
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: my-app-role
  namespace: my-app
rules:
  - apiGroups: [""]
    resources: ["configmaps", "secrets"]
    verbs: ["get", "list", "watch"]
    resourceNames: ["my-app-config", "my-app-secrets"]
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: my-app-binding
  namespace: my-app
subjects:
  - kind: ServiceAccount
    name: my-app-sa
    namespace: my-app
roleRef:
  kind: Role
  name: my-app-role
  apiGroup: rbac.authorization.k8s.io

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredLabels
metadata:
  name: require-app-labels
spec:
  match:
    kinds:
      - apiGroups: ["apps"]
        kinds: ["Deployment"]
  parameters:
    labels: ["app", "team", "environment"]

terraform init && terraform fmt -check && terraform validate && terraform plan
terraform apply -auto-approve
terraform state list
terraform workspace list
terraform import aws_instance.my_instance i-1234567890abcdef0

kubectl get all -A
kubectl logs -f <pod> -n <ns>
kubectl describe pod <pod> -n <ns>
kubectl exec -it <pod> -n <ns> -- sh
kubectl rollout status deploy/<name> -n <ns>
kubectl rollout undo deploy/<name> -n <ns>

helm repo add <name> <url> && helm repo update
helm install <release> <chart> -f values.yaml -n <ns> --create-namespace
helm upgrade <release> <chart> -f values.yaml -n <ns>
helm list -A
helm uninstall <release> -n <ns>

ansible-playbook -i inventory.yml playbook.yml
ansible-playbook -i inventory.yml playbook.yml --check --diff
ansible-inventory -i inventory.yml --list
ansible all -i inventory.yml -m ping

# Port-forward for local access
kubectl port-forward -n monitoring svc/prometheus-k8s 9090:9090
kubectl port-forward -n monitoring svc/grafana 3000:3000
kubectl port-forward -n monitoring svc/loki 3100:3100

# Check Prometheus targets
curl http://localhost:9090/api/v1/targets

# Query Loki
curl "http://localhost:3100/loki/api/v1/query_range?query={app='my-app'}&limit=100"