GitOps, Helm e Architetture Cloud Provider

apiVersion: v2          # Helm 3 (v1 = Helm 2)
name: myapp
description: A Helm chart for myapp API server
type: application       # o "library" per chart di utilità
version: 0.3.0          # Versione del chart (SemVer)
appVersion: "1.5.2"     # Versione dell'applicazione (informativo)
dependencies:
- name: postgresql
  version: "15.x.x"
  repository: https://charts.bitnami.com/bitnami
  condition: postgresql.enabled   # Disabilita con --set postgresql.enabled=false

replicaCount: 2

image:
  repository: registry.example.com/myapp
  pullPolicy: IfNotPresent
  tag: ~                # null in YAML → il filtro `default` usa .Chart.AppVersion come fallback.
                        # ATTENZIONE: una stringa vuota "" è un valore valido in Helm — `default`
                        # NON scatta per stringhe vuote, solo per nil/non-set. Usa null (~) o ometti
                        # il campo per il comportamento corretto.
                        # Override in CI: --set image.tag=sha-abc123

service:
  type: ClusterIP
  port: 80

ingress:
  enabled: false
  className: nginx
  hosts:
  - host: myapp.example.com
    paths:
    - path: /
      pathType: Prefix
  tls: []

resources:
  requests:
    cpu: 100m
    memory: 128Mi
  limits:
    cpu: 500m
    memory: 256Mi

autoscaling:
  enabled: false
  minReplicas: 2
  maxReplicas: 10
  # Usa "targetCPUAverageUtilization" (allineato con autoscaling/v2 averageUtilization)
  # NON "targetCPUUtilizationPercentage" che è la naming convention di HPA v1 (autoscaling/v1)
  targetCPUAverageUtilization: 60

serviceAccount:
  create: true
  name: ""

postgresql:
  enabled: true         # Abilita il sub-chart PostgreSQL
  auth:
    database: myapp
    username: myapp
    # IMPORTANTE: non committare la password in values.yaml!
    # In produzione, usa: --set postgresql.auth.password=<secret>
    # oppure External Secrets Operator per sincronizzare la password da Vault/AWS SSM

{{/*
Expand the name of the chart.
*/}}
{{- define "myapp.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
{{- end }}

{{/*
Full name: release + chart (troncato a 63 char per compatibilità K8s)
*/}}
{{- define "myapp.fullname" -}}
{{- if .Values.fullnameOverride }}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- $name := default .Chart.Name .Values.nameOverride }}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- end }}

{{/*
Standard labels su tutte le risorse
*/}}
{{- define "myapp.labels" -}}
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
app.kubernetes.io/name: {{ include "myapp.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
{{- end }}

apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "myapp.fullname" . }}
  labels:
    {{- include "myapp.labels" . | nindent 4 }}
spec:
  {{- if not .Values.autoscaling.enabled }}
  replicas: {{ .Values.replicaCount }}
  {{- end }}
  selector:
    matchLabels:
      app.kubernetes.io/name: {{ include "myapp.name" . }}
      app.kubernetes.io/instance: {{ .Release.Name }}
  template:
    metadata:
      labels:
        {{- include "myapp.labels" . | nindent 8 }}
    spec:
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      serviceAccountName: {{ include "myapp.serviceAccountName" . }}
      containers:
      - name: {{ .Chart.Name }}
        image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
        imagePullPolicy: {{ .Values.image.pullPolicy }}
        ports:
        - name: http
          containerPort: 8080
          protocol: TCP
        livenessProbe:
          httpGet:
            path: /health
            port: http
        readinessProbe:
          httpGet:
            path: /ready
            port: http
        resources:
          {{- toYaml .Values.resources | nindent 12 }}

# templates/db-migration.yaml — Hook per migrazione DB prima dell'upgrade
apiVersion: batch/v1
kind: Job
metadata:
  name: {{ include "myapp.fullname" . }}-migrate
  annotations:
    "helm.sh/hook": pre-upgrade,pre-install
    "helm.sh/hook-weight": "-5"          # Ordine (più basso = prima)
    "helm.sh/hook-delete-policy": hook-succeeded  # Elimina il Job se ha successo
spec:
  template:
    spec:
      restartPolicy: Never
      containers:
      - name: migrate
        image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
        command: ["./migrate", "--up"]

# ArgoCD Application — definisce COSA sincronizzare e DOVE
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: myapp
  namespace: argocd
spec:
  project: default
  source:
    repoURL: http://gitea.local/team/myapp
    targetRevision: main         # branch, tag, o commit SHA
    path: helm/myapp             # directory nel repo con il chart
    helm:
      valueFiles:
      - values-prod.yaml
      parameters:
      - name: image.tag
        value: "v1.5.2"
  destination:
    server: https://kubernetes.default.svc   # cluster locale
    namespace: production
  syncPolicy:
    automated:
      selfHeal: true       # Ripristina modifiche manuali entro ~3 minuti
      prune: true          # Elimina risorse non più nel repo
    syncOptions:
    - CreateNamespace=true
    - PrunePropagationPolicy=foreground

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: myapp-hpa
  namespace: production
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: myapp
  minReplicas: 2
  maxReplicas: 20
  metrics:
  # Scala su CPU
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 60   # Scala quando CPU media > 60%
  # Scala su memoria
  - type: Resource
    resource:
      name: memory
      target:
        type: AverageValue
        averageValue: 200Mi
  # Scala su metrica custom (richiede custom metrics adapter)
  - type: Pods
    pods:
      metric:
        name: http_requests_per_second
      target:
        type: AverageValue
        averageValue: "100"     # 100 req/sec per Pod
  # Scala su metrica esterna (es. lunghezza coda)
  - type: External
    external:
      metric:
        name: queue_messages_ready
        selector:
          matchLabels:
            queue: orders
      target:
        type: AverageValue
        averageValue: "30"     # 30 messaggi per Pod
  behavior:
    scaleUp:
      stabilizationWindowSeconds: 30    # Aspetta 30s prima di scalare su
      policies:
      - type: Percent
        value: 100                       # Può raddoppiare in una volta
        periodSeconds: 15
    scaleDown:
      stabilizationWindowSeconds: 300   # Aspetta 5 minuti prima di scalare giù
      policies:
      - type: Pods
        value: 1                         # Rimuove al max 1 Pod alla volta
        periodSeconds: 60

behavior:
  scaleUp:
    stabilizationWindowSeconds: 0     # Scala immediatamente (default: 0)
    selectPolicy: Max                  # Usa la policy più aggressiva
    policies:
    - type: Percent
      value: 100                       # Raddoppia
      periodSeconds: 15
    - type: Pods
      value: 4                         # Oppure aggiungi 4 Pod
      periodSeconds: 15
  scaleDown:
    stabilizationWindowSeconds: 300   # Aspetta 5 min (default: 300)
    selectPolicy: Min                  # Usa la policy meno aggressiva
    policies:
    - type: Pods
      value: 1
      periodSeconds: 60

# ScaledObject KEDA: scala su lunghezza coda RabbitMQ
apiVersion: keda.sh/v1alpha1
kind: ScaledObject
metadata:
  name: order-processor
spec:
  scaleTargetRef:
    name: order-processor
  minReplicaCount: 0    # ← può scalare a ZERO (HPA nativo non può!)
  maxReplicaCount: 50
  triggers:
  - type: rabbitmq
    metadata:
      queueName: orders
      queueLength: "5"   # 1 Pod per ogni 5 messaggi in coda

apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: myapp
spec:
  replicas: 10
  strategy:
    canary:
      steps:
      - setWeight: 10       # 10% del traffico al canary
      - pause: {duration: 5m}
      - setWeight: 30       # 30%
      - pause: {duration: 5m}
      - setWeight: 60       # 60%
      - pause: {duration: 10m}
      # Se tutto ok, promuovi al 100%
      analysis:
        templates:
        - templateName: success-rate
          args:
          - name: service-name
            value: myapp

# ClusterIssuer per Let's Encrypt (produzione)
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: admin@example.com
    privateKeySecretRef:
      name: letsencrypt-prod-key
    solvers:
    - http01:
        ingress:
          class: nginx

# Ingress con TLS automatico — basta aggiungere l'annotation!
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: myapp
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt-prod"  # ← questa annotation basta
spec:
  tls:
  - hosts:
    - myapp.example.com
    secretName: myapp-tls       # cert-manager crea e rinnova questo Secret
  rules:
  - host: myapp.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: myapp
            port:
              number: 80