k8s/
├── base/                           # Базовые манифесты (общие для всех env)
│   ├── kustomization.yaml
│   ├── namespace.yaml
│   ├── customer-core/
│   │   ├── deployment.yaml
│   │   ├── service.yaml
│   │   ├── hpa.yaml
│   │   └── pdb.yaml
│   ├── billing/
│   │   ├── deployment.yaml
│   │   ├── service.yaml
│   │   ├── hpa.yaml
│   │   └── pdb.yaml
│   ├── provisioning/
│   │   └── ...
│   ├── rabbitmq/
│   │   ├── statefulset.yaml
│   │   ├── service.yaml
│   │   └── configmap.yaml
│   └── common/
│       ├── network-policies.yaml
│       ├── resource-quotas.yaml
│       └── limit-ranges.yaml
├── components/                     # Переиспользуемые компоненты
│   ├── monitoring/
│   │   ├── kustomization.yaml
│   │   ├── service-monitor.yaml
│   │   └── prometheus-rules.yaml
│   ├── tracing/
│   │   ├── kustomization.yaml
│   │   └── otel-collector.yaml
│   └── security/
│       ├── kustomization.yaml
│       ├── network-policy-strict.yaml
│       └── pod-security-standards.yaml
└── overlays/                       # Окружения (патчи поверх base)
    ├── dev/
    │   ├── kustomization.yaml
    │   ├── patches/
    │   │   ├── replicas.yaml       # replicas: 1
    │   │   └── resources.yaml      # cpu: 100m, memory: 128Mi
    │   └── configmap-env.yaml
    ├── staging/
    │   ├── kustomization.yaml
    │   ├── patches/
    │   │   ├── replicas.yaml       # replicas: 2
    │   │   └── resources.yaml      # cpu: 250m, memory: 256Mi
    │   └── configmap-env.yaml
    └── production/
        ├── kustomization.yaml
        ├── patches/
        │   ├── replicas.yaml       # replicas: 3
        │   ├── resources.yaml      # cpu: 500m, memory: 512Mi
        │   └── tolerations.yaml
        ├── configmap-env.yaml
        └── sealed-secrets/

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

namespace: isp-platform

commonLabels:
  app.kubernetes.io/part-of: isp-platform
  app.kubernetes.io/managed-by: kustomize

resources:
  - namespace.yaml
  - customer-core/
  - billing/
  - provisioning/
  - rabbitmq/
  - common/

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

resources:
  - ../../base

components:
  - ../../components/monitoring
  - ../../components/tracing
  - ../../components/security

patches:
  - path: patches/replicas.yaml
  - path: patches/resources.yaml
  - path: patches/tolerations.yaml

configMapGenerator:
  - name: app-config
    behavior: merge
    literals:
      - LOG_LEVEL=info
      - ENVIRONMENT=production

images:
  - name: customer-core
    newName: registry.example.com/isp/customer-core
    newTag: v1.2.3
  - name: billing
    newName: registry.example.com/isp/billing
    newTag: v1.1.0

apiVersion: apps/v1
kind: Deployment
metadata:
  name: customer-core
  labels:
    app.kubernetes.io/name: customer-core
    app.kubernetes.io/component: bss
spec:
  replicas: 2
  selector:
    matchLabels:
      app.kubernetes.io/name: customer-core
  template:
    metadata:
      labels:
        app.kubernetes.io/name: customer-core
    spec:
      serviceAccountName: customer-core
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        fsGroup: 1000
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: customer-core
          image: customer-core:latest # Overridden by Kustomize images
          ports:
            - name: grpc
              containerPort: 8080
              protocol: TCP
            - name: metrics
              containerPort: 9090
              protocol: TCP
          envFrom:
            - configMapRef:
                name: app-config
            - secretRef:
                name: customer-core-secrets
          resources:
            requests:
              cpu: 250m
              memory: 256Mi
            limits:
              memory: 512Mi # Без CPU limit (best practice)
          livenessProbe:
            grpc:
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 10
          readinessProbe:
            grpc:
              port: 8080
            initialDelaySeconds: 3
            periodSeconds: 5
          startupProbe:
            grpc:
              port: 8080
            failureThreshold: 30
            periodSeconds: 2
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: kubernetes.io/hostname
          whenUnsatisfiable: DoNotSchedule
          labelSelector:
            matchLabels:
              app.kubernetes.io/name: customer-core

# Пример: Billing может подключаться только к своей PostgreSQL и RabbitMQ
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: billing-egress
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: billing
  policyTypes:
    - Egress
  egress:
    - to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: postgresql-billing
      ports:
        - port: 5432
    - to:
        - podSelector:
            matchLabels:
              app.kubernetes.io/name: rabbitmq
      ports:
        - port: 5672
    - to: # DNS
        - namespaceSelector: {}
      ports:
        - port: 53
          protocol: UDP

# ArgoCD Application (deploy/applications/isp-platform.yaml)
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: isp-platform
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://gitlab.local/isp-platform/g-service-monorepo.git
    targetRevision: HEAD
    path: infra/chart
    helm:
      valueFiles:
        - values.yaml
        - values.production.yaml
  destination:
    server: https://kubernetes.default.svc
    namespace: isp-platform
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true

# --- Build stage ---
FROM oven/bun:1.3-alpine AS builder
WORKDIR /app
COPY bun.lock package.json ./
RUN bun install --frozen-lockfile
COPY . .
RUN bun run build

# --- Runtime stage ---
FROM oven/bun:1.3-alpine
RUN addgroup -g 1001 -S bunjs && adduser -S nestjs -u 1001
WORKDIR /app
COPY --from=builder --chown=nestjs:bunjs /app/dist ./dist
COPY --from=builder --chown=nestjs:bunjs /app/node_modules ./node_modules
COPY --from=builder --chown=nestjs:bunjs /app/package.json ./
USER nestjs
EXPOSE 8080
CMD ["bun", "run", "dist/main.js"]

FROM golang:1.23-alpine AS builder
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o /app/server ./cmd/mediation/

FROM gcr.io/distroless/static-debian12:nonroot
COPY --from=builder /app/server /server
USER nonroot:nonroot
EXPOSE 8080 9090
ENTRYPOINT ["/server"]