# В GitLab CI
trivy:
  stage: security
  script:
    - trivy --cache-dir .trivycache/ image $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
  cache:
    paths:
      - .trivycache/

apiVersion: v1
kind: Pod
metadata:
  name: my-secure-pod
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1001
    runAsGroup: 1001
    fsGroup: 1001
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: myapp
    image: myapp:latest
    securityContext:
      allowPrivilegeEscalation: false
      capabilities:
        drop:
          - ALL

resources:
  requests:
    memory: "128Mi"
    cpu: "100m"
  limits:
    memory: "256Mi"
    cpu: "500m"

rule: Terminal shell in container
  desc: A shell was used as the entrypoint/exec point into a container with an attached terminal
  condition: >
    spawned_process and container
    and shell_procs and proc.tty != 0
    and container_entrypoint
  output: >
    A shell was spawned in a container with an attached terminal (user=%user.name %container.info shell=%proc.name parent=%proc.pname cmdline=%proc.cmdline)
  priority: WARNING

# В GitLab CI
test_image_size:
  stage: test
  script:
    - SIZE=$(docker images --format "{{.Size}}" $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA | sed 's/MB//')
    - if [ $SIZE -gt 200 ]; then echo "Image size exceeds 200MB!"; exit 1; fi

# docker-compose.yml для быстрого разворачивания
version: '3'
services:
  cadvisor:
    image: gcr.io/cadvisor/cadvisor:latest
    volumes:
      - /:/rootfs:ro
      - /var/run:/var/run:ro
      - /sys:/sys:ro
      - /var/lib/docker/:/var/lib/docker:ro
    ports:
      - "8080:8080"
  prometheus:
    image: prom/prometheus:latest
    volumes:
      - ./prometheus.yml:/etc/prometheus/prometheus.yml
    ports:
      - "9090:9090"
  grafana:
    image: grafana/grafana:latest
    ports:
      - "3000:3000"

apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: app-monitor
  namespace: monitoring
spec:
  selector:
    matchLabels:
      app: myapp
  endpoints:
  - port: metrics
    interval: 15s

name: Check Image Size
 
on:
  pull_request:
    branches: [ main ]
 
jobs:
  check-image-size:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - name: Build image
        run: docker build -t testimage:${{ github.sha }} .
      - name: Check size
        run: |
          SIZE=$(docker images testimage:${{ github.sha }} --format "{{.Size}}" | sed 's/MB//')
          if (( $(echo "$SIZE > 200" | bc -l) )); then
            echo "::error::Image size $SIZE MB exceeds limit of 200 MB"
            exit 1
          fi

image_metrics:
  stage: metrics
  script:
    - SIZE=$(docker images $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA --format "{{.Size}}")
    - STARTUP_TIME=$(time_container_startup $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA)
    - VULN_COUNT=$(trivy image --format json $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA | jq '.Vulnerabilities | length')
    - echo "size=${SIZE},startup_time=${STARTUP_TIME},vuln_count=${VULN_COUNT}" >> metrics.txt
  artifacts:
    paths:
      - metrics.txt

version: '3.8'
 
services:
  api:
    build:
      context: ./api
      dockerfile: Dockerfile
      target: development  # Для разработки используем другой target
    volumes:
      - ./api:/app
    ports:
      - "8000:8000"
    environment:
      - DATABASE_URL=postgresql://postgres:postgres@db:5432/app
      - REDIS_URL=redis://redis:6379/0
    depends_on:
      - db
      - redis
 
  web:
    build:
      context: ./web
      dockerfile: Dockerfile
      target: development
    volumes:
      - ./web:/app
      - /app/node_modules
    ports:
      - "3000:3000"
    environment:
      - API_URL=http://api:8000
 
  auth:
    build:
      context: ./auth
      dockerfile: Dockerfile
    ports:
      - "8080:8080"
    environment:
      - DATABASE_URL=postgresql://postgres:postgres@db:5432/auth
      - REDIS_URL=redis://redis:6379/1
    depends_on:
      - db
      - redis
 
  db:
    image: postgres:15-alpine
    volumes:
      - postgres_data:/var/lib/postgresql/data
    environment:
      - POSTGRES_PASSWORD=postgres
      - POSTGRES_USER=postgres
      - POSTGRES_DB=app
 
  redis:
    image: redis:7-alpine
    volumes:
      - redis_data:/data
 
volumes:
  postgres_data:
  redis_data:

name: Build and Test
 
on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
 
jobs:
  build-and-test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2
      
      - name: Build API
        uses: docker/build-push-action@v4
        with:
          context: ./api
          push: false
          load: true
          tags: api:test
          cache-from: type=gha
          cache-to: type=gha,mode=max
      
      - name: Check Image Size
        run: |
          SIZE=$(docker images api:test --format "{{.Size}}" | sed 's/MB//')
          if (( $(echo "$SIZE > 200" | bc -l) )); then
            echo "::warning::API image size $SIZE MB exceeds recommended limit of 200 MB"
          fi
      
      - name: Scan for vulnerabilities
        run: |
          docker run --rm -v /tmp:/tmp aquasec/trivy image --format json --output /tmp/results.json api:test
          HIGH_VULNS=$(cat /tmp/results.json | jq '.Results[].Vulnerabilities[] | select(.Severity=="HIGH" or .Severity=="CRITICAL") | .VulnerabilityID' | wc -l)
          if [ $HIGH_VULNS -gt 0 ]; then
            echo "::error::Found $HIGH_VULNS HIGH or CRITICAL vulnerabilities"
            exit 1
          fi

replicaCount: 3
 
image:
  repository: company-registry.com/enterprise-app/api
  tag: latest
  pullPolicy: Always
 
resources:
  limits:
    cpu: 500m
    memory: 512Mi
  requests:
    cpu: 200m
    memory: 256Mi
 
livenessProbe:
  httpGet:
    path: /health
    port: http
  initialDelaySeconds: 10
  periodSeconds: 30
 
securityContext:
  runAsUser: 1001
  runAsGroup: 1001
  fsGroup: 1001
  runAsNonRoot: true
  allowPrivilegeEscalation: false
  capabilities:
    drop:
      - ALL

# ConfigMap для публичной конфигурации
apiVersion: v1
kind: ConfigMap
metadata:
  name: api-config
data:
  LOG_LEVEL: "INFO"
  FEATURE_FLAGS: "new_ui=true,beta_search=false"
 
# SealedSecret для защищенного хранения чувствительных данных
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  name: api-secrets
spec:
  encryptedData:
    DATABASE_PASSWORD: AgByd1DLmw6...
    API_KEY: AgCHd5tDxG9...

# Prometheus ServiceMonitor для API
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: api-monitor
spec:
  selector:
    matchLabels:
      app: api
  endpoints:
  - port: metrics
    interval: 15s
    path: /metrics

metadata:
  labels:
    vcluster.loft.sh/managed-by: vcluster-pipeline-12632713145

kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: isolate-vcluster
  namespace: vcluster-vcluster-pipeline-12632713145
spec:
  podSelector: {}
  ingress:
  - from:
    - podSelector: {}

apiVersion: v1
kind: ResourceQuota
metadata:
  name: vcluster-quota
spec:
  hard:
    limits.cpu: "4"
    limits.memory: 8Gi
    requests.cpu: "2"
    requests.memory: 4Gi

syncer:
  extraArgs:
    - --disable-sync-resources=persistentvolumeclaims
storage:
  persistence: false  # SQLite
  # или для полноценного кластера
  # persistence: true  # etcd

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: isolate-vcluster
  namespace: vcluster-pr-1234
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - podSelector: {}
  egress:
  - to:
    - podSelector: {}
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
    ports:
    - port: 53
      protocol: UDP
    - port: 53
      protocol: TCP

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: app-ingress
spec:
  rules:
  - host: pr-1234-app.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: app-service
            port:
              number: 80

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: protect-api-server
  namespace: vcluster-pr-1234
spec:
  podSelector:
    matchLabels:
      app: vcluster
  ingress:
  - from:
    - ipBlock:
        cidr: 10.0.0.0/8

name: Install vCluster
  uses: loft-sh/setup-vcluster@main
  with:
    kubectl-install: false
name: Create a vCluster
  id: vcluster
  run: time vcluster create vcluster-pipeline-${{github.run_id}}
name: Connect to the vCluster
  run: vcluster connect vcluster-pipeline-${{github.run_id}}

name: Install PostgreSQL
  run: |
    helm repo add bitnami [url]https://charts.bitnami.com/bitnami[/url]
    helm install postgres bitnami/postgresql -f postgres-values.yaml
name: Create ConfigMap with DB connection
  run: |
    kubectl create configmap db-config --from-literal=host=postgres-postgresql --from-literal=port=5432
name: Deploy application
  run: |
    kubectl apply -k ./k8s/overlays/test
name: Wait for deployment
  run: |
    kubectl rollout status deployment/my-app

name: Get Service URL
  run: |
    external_ip=""
    while [ -z $external_ip ]; do
      echo "Waiting for external IP..."
      external_ip=$(kubectl get svc my-app -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
      [ -z "$external_ip" ] && sleep 10
    done
    echo "APP_URL=http://$external_ip:8080" >> $GITHUB_ENV

name: Delete the vCluster
  if: ${{ !cancelled() && steps.vcluster.conclusion == 'success' }}
  run: vcluster delete vcluster-pipeline-${{github.run_id}}

# values.yaml для vCluster
syncer:
  extraArgs:
    - --disable-sync-resources=nodes
    - --enforce-pod-security-standard=baseline
storage:
  persistence: false  # Используем SQLite для тестовых окружений
ingress:
  enabled: true
  host: "pr-${PR_NUMBER}.test.example.com"

on:
  issue_comment:
    types: [created]
jobs:
  deploy-test:
    if: github.event.issue.pull_request && contains(github.event.comment.body, '/deploy-test')
    runs-on: ubuntu-latest
    steps:
      # Дальнейшие шаги по созданию vCluster

name: Store cluster info
  if: steps.vcluster.conclusion == 'success'
  run: |
    echo "vcluster-pipeline-${{github.run_id}}" > cluster_name.txt
    aws s3 cp cluster_name.txt s3://my-bucket/pr-${{github.event.pull_request.number}}/

on:
  pull_request:
    types: [closed]
jobs:
  cleanup:
    runs-on: ubuntu-latest
    steps:
      - name: Download cluster info
        run: |
          aws s3 cp s3://my-bucket/pr-${{github.event.pull_request.number}}/cluster_name.txt .
          CLUSTER_NAME=$(cat cluster_name.txt)
          echo "CLUSTER_NAME=$CLUSTER_NAME" >> $GITHUB_ENV
      - name: Install vCluster
        uses: loft-sh/setup-vcluster@main
      - name: Delete vCluster
        run: vcluster delete ${{ env.CLUSTER_NAME }}

name: Set expiration
  run: |
    EXPIRATION=$(date -d "now + 24 hours" +%s)
    echo "$EXPIRATION" > expiration.txt
    aws s3 cp expiration.txt s3://my-bucket/pr-${{github.event.pull_request.number}}/

on:
  schedule:
    - cron: '0 * * * *'  # Каждый час
jobs:
  cleanup-expired:
    runs-on: ubuntu-latest
    steps:
      # Логика проверки и удаления истекших кластеров

variables:
  KUBECONFIG: "$CI_PROJECT_DIR/.kube/config"
 
stages:
  - prepare
  - deploy
  - test
  - cleanup
 
setup_vcluster:
  stage: prepare
  image: alpine:3.14
  script:
    - apk add --no-cache curl
    - curl -L -o vcluster "https://github.com/loft-sh/vcluster/releases/latest/download/vcluster-linux-amd64"
    - chmod +x vcluster
    - mkdir -p .kube
    - ./vcluster create vcluster-$CI_PIPELINE_ID --connect=false
    - ./vcluster connect vcluster-$CI_PIPELINE_ID --update-current=false --kube-config=$KUBECONFIG
  artifacts:
    paths:
      - vcluster
      - .kube/

version: 2.1
jobs:
  deploy:
    docker:
      - image: cimg/base:2022.03
    steps:
      - checkout
      - run:
          name: Install vCluster
          command: |
            curl -L -o vcluster "https://github.com/loft-sh/vcluster/releases/latest/download/vcluster-linux-amd64"
            chmod +x vcluster
      - run:
          name: Create vCluster
          command: |
            mkdir -p $PWD/.kube
            export KUBECONFIG=$PWD/.kube/config
            ./vcluster create vcluster-$CIRCLE_BUILD_NUM

# vcluster-template/Chart.yaml
apiVersion: v2
name: pr-environment
description: PR Test Environment Template
version: 0.1.0

# vcluster-template/values.yaml
vcluster:
  name: "pr-environment"
  namespace: "vcluster-pr"
  persistence: false
  isolation:
    enabled: true
  resources:
    limits:
      cpu: 1
      memory: 1Gi
 
services:
  database:
    enabled: true
    type: postgres
    version: "13"
  
  redis:
    enabled: false

# vcluster-template/templates/vcluster.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: {{ printf "vcluster-%s-%s" .Values.vcluster.name .Release.Name | trunc 63 }}

# pr-1234-values.yaml
vcluster:
  name: "pr-1234"
  resources:
    limits:
      cpu: 2
      memory: 2Gi

apiVersion: v1
kind: ResourceQuota
metadata:
  name: vcluster-quota
spec:
  hard:
    limits.cpu: "4"
    limits.memory: 8Gi
    pods: "20"

apiVersion: scheduling.k8s.io/v1
kind: PriorityClass
metadata:
  name: high-priority
value: 1000000

apiVersion: v1
kind: LimitRange
metadata:
  name: default-limits
spec:
  limits:
  - default:
      cpu: 500m
      memory: 512Mi

apiVersion: helm.fluxcd.io/v1
kind: HelmRelease
metadata:
name: fluent-bit
spec:
values:
  config:
    outputs: |
      [OUTPUT]
          Name es
          Match *
          Host elasticsearch-master
          Logstash_Format On
          Logstash_Prefix vcluster-${VCLUSTER_NAME}

apiVersion: v1
kind: ConfigMap
metadata:
name: otel-agent-conf
data:
  config.yaml: |
    receivers:
      otlp:
        protocols:
          grpc:
            endpoint: 0.0.0.0:4317
    processors:
      batch:
      attributes:
        actions:
          - key: vcluster.name
            value: ${VCLUSTER_NAME}
            action: insert
    exporters:
      otlp:
        endpoint: jaeger-collector:4317

apiVersion: apps/v1
kind: Deployment
metadata:
name: syncer
spec:
template:
  spec:
    containers:
    - name: log-interceptor
      image: busybox
      command: ["/bin/sh", "-c", "tail -f /var/log/syncer/syncer.log | sed 's/^/[vcluster-$VCLUSTER_NAME] /' > /dev/stdout"]
      volumeMounts:
      - name: syncer-logs
        mountPath: /var/log/syncer

apiVersion: batch/v1
kind: Job
metadata:
name: db-init
spec:
template:
spec:
  containers:
  - name: init
    image: my-repo/db-init:latest
    env:
    - name: DB_HOST
      value: postgres
    - name: DB_PASSWORD
      valueFrom:
        secretKeyRef:
          name: db-credentials
          key: postgres-password
  restartPolicy: Never

initContainers:
name: wait-for-api
  image: busybox
  command: ['sh', '-c', 'until nc -z api-service 8080; do echo waiting for api; sleep 2; done;']

apiVersion: batch/v1
kind: CronJob
metadata:
name: cleanup-vclusters
spec:
schedule: "0 * * * *"  # Каждый час
jobTemplate:
spec:
  template:
    spec:
      containers:
      - name: cleanup
        image: my-registry/cleanup-tool:latest
        env:
        - name: GITHUB_TOKEN
          valueFrom:
            secretKeyRef:
              name: github-creds
              key: token
      restartPolicy: OnFailure

metadata:
  labels:
    vcluster.name: "pr-1234"
    team: "backend"
    pr.owner: "username"
    cost-center: "dev-infra"

sum by(vcluster_name) (
  kube_pod_container_resource_requests{resource="cpu"}
  * on(namespace,pod) group_left(vcluster_name)
  kube_pod_labels{label_vcluster_name!=""}
)

apiVersion: batch/v1
kind: CronJob
metadata:
  name: cost-optimizer
spec:
  schedule: "0 * * * *"
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: optimizer
            image: my-repo/cost-optimizer:v1
            args:
            - --idle-threshold=3h
            - --notify-slack=true

resources:
  limits:
    memory: 1Gi
    cpu: 500m
  requests:
    memory: 256Mi
    cpu: 100m

vcluster-pr-testing/
├── .github/
│   └── workflows/
│       └── pr-test.yaml
├── k8s/
│   ├── base/
│   └── overlays/
│       └── test/
└── scripts/
    ├── cleanup.sh
    └── setup-vcluster.sh

name: PR Test
 
on:
  pull_request:
    types: [opened, synchronize, reopened]
 
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      - name: Setup Kubernetes tools
        uses: azure/setup-kubectl@v3
        
      - name: Setup vCluster
        uses: loft-sh/setup-vcluster@main
        
      - name: Create vCluster
        id: create-vcluster
        run: |
          vcluster create pr-${{ github.event.pull_request.number }} \
            --connect=false \
            --distro=k3s \
            --expose
          echo "VCLUSTER_NAME=pr-${{ github.event.pull_request.number }}" >> $GITHUB_ENV
      
      - name: Connect to vCluster
        run: vcluster connect ${{ env.VCLUSTER_NAME }}
      
      - name: Deploy test environment
        run: |
          kubectl apply -k ./k8s/overlays/test
          kubectl rollout status deployment/app
      
      - name: Run tests
        run: ./scripts/run-tests.sh
      
      - name: Delete vCluster
        if: always()
        run: vcluster delete ${{ env.VCLUSTER_NAME }}

User Request -> API Gateway -> Auth Service -> Product Service -> DB
                                            \-> Image Service -> Storage
                                            \-> Recommendation Service -> ML Model

http_requests_total{service="api", namespace="production", endpoint="/users", method="GET", status="200"} 12345

receivers:
  otlp:
    protocols:
      grpc:
        endpoint: 0.0.0.0:4317
      http:
        endpoint: 0.0.0.0:4318
 
processors:
  batch:
    timeout: 1s
    send_batch_size: 1024
  memory_limiter:
    check_interval: 1s
    limit_mib: 1000
    spike_limit_mib: 200
 
exporters:
  otlp:
    endpoint: "jaeger:4317"
    tls:
      insecure: true
  logging:
    verbosity: detailed
 
service:
  pipelines:
    traces:
      receivers: [otlp]
      processors: [memory_limiter, batch]
      exporters: [otlp, logging]

processors:
  probabilistic_sampler:
    hash_seed: 22
    sampling_percentage: 15

processors:
  memory_limiter:
    check_interval: 1s
    limit_mib: 2000
    spike_limit_mib: 500
  batch:
    timeout: 10s
    send_batch_size: 10000
    send_batch_max_size: 20000

resources:
  requests:
    cpu: 500m
    memory: 2Gi
  limits:
    cpu: 1000m
    memory: 4Gi

-XX:MaxRAMPercentage=75.0 -XX:InitialRAMPercentage=50.0

processors:
  batch:
    timeout: 5s
    send_batch_size: 8192
    send_batch_max_size: 16384
 
exporters:
  otlp/jaeger:
    endpoint: jaeger:4317
    retry_on_failure:
      enabled: true
      initial_interval: 5s
      max_interval: 30s
      max_elapsed_time: 300s

exporters:
  otlp/jaeger:
    sending_queue:
      enabled: true
      num_consumers: 10
      queue_size: 5000

processors:
  filter/healthchecks:
    traces:
      span:
        - 'resource.attributes["http.url"] contains "/health"'
        - 'resource.attributes["http.url"] contains "/ready"'

apiVersion: v1
kind: Secret
metadata:
  name: jaeger-credentials
type: Opaque
data:
  username: amFlZ2VyVXNlcg==  # base64 encoded "jaegerUser"
  password: c3VwZXJTZWNyZXQxMjM=  # base64 encoded "superSecret123"

extraEnvs:
  - name: JAEGER_USERNAME
    valueFrom:
      secretKeyRef:
        name: jaeger-credentials
        key: username
  - name: JAEGER_PASSWORD
    valueFrom:
      secretKeyRef:
        name: jaeger-credentials
        key: password

exporters:
  otlp/jaeger:
    endpoint: jaeger:4317
    headers:
      Authorization: "Basic ${JAEGER_USERNAME}:${JAEGER_PASSWORD}"

exporters:
otlp/jaeger:
  endpoint: jaeger:4317
  headers:
    Authorization: "${VAULT_SECRET}"

receivers:
otlp:
  protocols:
    grpc:
      endpoint: 0.0.0.0:4317
    http:
      endpoint: 0.0.0.0:4318
 
processors:
batch:
  timeout: 1s
  send_batch_size: 512
 
exporters:
otlp:
  endpoint: "otel-collector-gateway:4317"
  tls:
    insecure: true
 
service:
pipelines:
  traces:
    receivers: [otlp]
    processors: [batch]
    exporters: [otlp]

receivers:
otlp:
  protocols:
    grpc:
      endpoint: 0.0.0.0:4317
 
processors:
batch:
  timeout: 10s
  send_batch_size: 10000
memory_limiter:
  check_interval: 5s
  limit_mib: 4000
 
exporters:
otlp/jaeger:
  endpoint: "jaeger:4317"
  tls:
    insecure: true
 
service:
pipelines:
  traces:
    receivers: [otlp]
    processors: [memory_limiter, batch]
    exporters: [otlp/jaeger]

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: otel-agent
spec:
  selector:
    matchLabels:
      app: otel-agent
  template:
    metadata:
      labels:
        app: otel-agent
    spec:
      containers:
      - name: otel-agent
        image: otel/opentelemetry-collector:0.64.0
        args:
        - "--config=/conf/config.yaml"
        volumeMounts:
        - name: config
          mountPath: /conf
      volumes:
      - name: config
        configMap:
          name: otel-agent-config

apiVersion: v1
kind: Service
metadata:
  name: otel-collector-gateway
spec:
  selector:
    app: otel-collector-gateway
  ports:
  - port: 4317
    targetPort: 4317
    protocol: TCP
  sessionAffinity: ClientIP
  sessionAffinityConfig:
    clientIP:
      timeoutSeconds: 10800

apiVersion: opentelemetry.io/v1alpha1
kind: Instrumentation
metadata:
  name: my-instrumentation
spec:
  exporter:
    endpoint: [url]http://otel-collector:4317[/url]
  propagators:
    - tracecontext
    - baggage
  sampler:
    type: parentbased_traceidratio
    argument: "0.25"

apiVersion: apps/v1
kind: Deployment
metadata:
  name: order-service
spec:
  template:
    metadata:
      annotations:
        instrumentation.opentelemetry.io/inject-java: "true"

apiVersion: v1
kind: ConfigMap
metadata:
  name: otel-k8s-events-config
data:
  config.yaml: |
    receivers:
      k8s_events:
        namespaces: [default, production]
    processors:
      resource:
        attributes:
          - key: k8s.event.type
            action: upsert
            value: kubernetes
    exporters:
      otlp:
        endpoint: otel-collector:4317
        tls:
          insecure: true
    service:
      pipelines:
        traces:
          receivers: [k8s_events]
          processors: [resource]
          exporters: [otlp]

apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: statefulset-monitor
spec:
  selector:
    matchLabels:
      app: database
  endpoints:
  - port: metrics
    interval: 15s

apiVersion: v1
kind: ConfigMap
metadata:
  name: postgres-exporter-config
data:
  queries.yaml: |
    pg_replication:
      query: "SELECT * FROM pg_stat_replication"
      metrics:
        - name: lag_bytes
          usage: "GAUGE"
          description: "Replication lag in bytes"

receivers:
  k8sobjects:
    objects:
      - name: events
        mode: watch
        group: ""
        version: v1
 
processors:
  k8sattributes:
    extract:
      metadata:
        - k8s.event.reason
        - k8s.event.message
 
exporters:
  otlp:
    endpoint: jaeger:4317
    tls:
      insecure: true
 
service:
  pipelines:
    traces:
      receivers: [k8sobjects]
      processors: [k8sattributes]
      exporters: [otlp]

receivers:
  prometheus:
    config:
      scrape_configs:
        - job_name: 'kube-state-metrics'
          kubernetes_sd_configs:
            - role: endpoints
              namespaces:
                names: ['kube-system']
          relabel_configs:
            - source_labels: [__meta_kubernetes_service_name]
              regex: 'kube-state-metrics'
              action: keep
 
processors:
  resource:
    attributes:
      - key: k8s.cluster.name
        value: production
        action: upsert
 
exporters:
  otlp:
    endpoint: otel-collector:4317
    tls:
      insecure: true
 
service:
  pipelines:
    metrics:
      receivers: [prometheus]
      processors: [resource]
      exporters: [otlp]

processors:
  metrics_transform:
    transforms:
      - include: process_order_duration_seconds
        action: aggregate
        aggregation:
          type: histogram
        operations:
          - group_by_attributes: ["customer.tier"]

deploy_production:
  stage: deploy
  script:
    - kubectl apply -f kubernetes/
    - |
      curl -X POST [url]http://otel-collector:4318/v1/traces[/url] \
      -H "Content-Type: application/json" \
      -d "{
        "resourceSpans": [{
          "resource": {
            "attributes": [
              {"key": "deployment.name", "value": {"stringValue": "$CI_PROJECT_NAME"}},
              {"key": "deployment.version", "value": {"stringValue": "$CI_COMMIT_SHORT_SHA"}}
            ]
          },
          "scopeSpans": [{
            "spans": [{
              "name": "deployment",
              "kind": 1,
              "startTimeUnixNano": "$(date +%s)000000000",
              "endTimeUnixNano": "$(date +%s)000000000"
            }]
          }]
        }]
      }"

exporters:
  otlp/honeycomb:
    endpoint: api.honeycomb.io:443
    headers:
      x-honeycomb-team: ${HONEYCOMB_API_KEY}
  otlp/lightstep:
    endpoint: ingest.lightstep.com:443
    headers:
      lightstep-access-token: ${LIGHTSTEP_ACCESS_TOKEN}

apiVersion: apps/v1
kind: Deployment
metadata:
  name: legacy-app
spec:
  template:
    spec:
      containers:
      - name: app
        image: legacy-app:1.0
        volumeMounts:
        - name: logs
          mountPath: /app/logs
      - name: log-to-trace
        image: custom-log-to-trace:1.0
        env:
        - name: LOG_PATH
          value: /logs/app.log
        - name: OTEL_EXPORTER_OTLP_ENDPOINT
          value: [url]http://otel-collector:4317[/url]
        volumeMounts:
        - name: logs
          mountPath: /logs
      volumes:
      - name: logs
        emptyDir: {}

processors:
  probabilistic_sampler:
    hash_seed: 22
    sampling_percentage: 10

processors:
  tail_sampling:
    decision_wait: 10s
    num_traces: 50000
    expected_new_traces_per_sec: 1000
    policies:
      - name: error-policy
        type: status_code
        status_code: ERROR
      - name: slow-policy 
        type: latency
        latency: 500ms
      - name: debug-policy
        type: string_attribute
        string_attribute:
          key: debug
          values: ["true"]
      - name: probabilistic-policy
        type: probabilistic
        probabilistic:
          sampling_percentage: 10

processors:
  batch:
    timeout: 5s
    send_batch_size: 8192
    send_batch_max_size: 12000
  memory_limiter:
    check_interval: 2s
    limit_mib: 4000
    spike_limit_mib: 800

processors:
  temporal_adjuster:
    driftage_correction:
      enabled: true
      duration_based: true

receivers:
  prometheus:
    config:
      scrape_configs:
        - job_name: 'data-pipeline-operator'
          kubernetes_sd_configs:
            - role: pod
          relabel_configs:
            - source_labels: [__meta_kubernetes_pod_label_app]
              regex: data-pipeline-operator
              action: keep
            - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape]
              regex: true
              action: keep

                         ┌─────────────┐
                         │   Traefik   │
                         │ API Gateway │
                         └──────┬──────┘
                                │
             ┌─────────────────┼─────────────────┐
             │                 │                 │
      ┌──────▼─────┐    ┌──────▼─────┐    ┌──────▼─────┐
      │  Каталог   │    │   Корзина  │    │ Рекомендации│
      │ (Spring)   │    │    (Go)    │    │  (Python)  │
      └──────┬─────┘    └──────┬─────┘    └─────────────┘
             │                 │
      ┌──────▼─────┐           │
      │   Склад    │◄──────────┘
      │  (Quarkus) │
      └──────┬─────┘
             │
      ┌──────▼─────┐
      │ Уведомления│
      │  (Node.js) │
      └─────────────┘

.
├── README.md
├── helm/
│   ├── infra/
│   │   ├── Chart.yaml
│   │   ├── values.yaml
│   │   └── templates/
│   │       ├── mosquitto-config.yaml
│   │       └── mosquitto.yaml
│   ├── apps/
│   │   ├── Chart.yaml
│   │   ├── values.yaml
│   │   ├── files/
│   │   │   └── sql/
│   │   │       ├── 01-create-tables.sql
│   │   │       └── 02-insert-data.sql
│   │   └── templates/
│   │       ├── catalog.yaml
│   │       ├── cart.yaml
│   │       ├── warehouse.yaml
│   │       ├── recommendations.yaml
│   │       ├── notifications.yaml
│   │       └── ingress.yaml
│   └── vcluster.yaml
├── services/
│   ├── catalog/
│   ├── cart/
│   ├── warehouse/
│   ├── recommendations/
│   └── notifications/
└── scripts/
    └── deploy.sh

dependencies:
name: valkey
  version: "*"
  repository: "https://charts.bitnami.com/bitnami"
name: traefik
  version: "*"
  repository: "https://helm.traefik.io/traefik"
name: opentelemetry-collector
  version: "*"
  repository: "https://open-telemetry.github.io/opentelemetry-helm-charts"
name: opentelemetry-operator
  version: "*"
  repository: "https://open-telemetry.github.io/opentelemetry-helm-charts"
name: jaeger
  version: "*"
  repository: "https://jaegertracing.github.io/helm-charts"
name: postgresql
  version: "*"
  repository: "https://charts.bitnami.com/bitnami"

apiVersion: apps/v1
kind: Deployment
metadata:
  name: catalog
spec:
  replicas: 1
  selector:
    matchLabels:
      app: catalog
  template:
    metadata:
      annotations:
        instrumentation.opentelemetry.io/inject-java: "true"
      labels:
        app: catalog

apiVersion: apps/v1
kind: Deployment
metadata:
  name: recommendations
spec:
  template:
    metadata:
      annotations:
        instrumentation.opentelemetry.io/inject-python: "true"

apiVersion: opentelemetry.io/v1alpha1
kind: Instrumentation
metadata:
  name: demo-instrumentation
spec:
  exporter:
    endpoint: [url]http://collector:4318[/url]
  propagators:
    - tracecontext
    - baggage
  sampler:
    type: parentbased_traceidratio
    argument: "1.0"  # Для демо берем все трейсы