# Kubernetes Defaults - Complex: Multi-service Kubernetes deployment
# Version: 1.0.0
#
# Scenario: Multi-service application with PostgreSQL, Kubernetes deployment,
#           Ingress, monitoring, autoscaling
# Use case: Production deployments, cloud-native applications

{
  kubernetes_defaults = {
    project = {
      name = "k8s-platform",
      version = "1.0.0",
      description = "Multi-service platform on Kubernetes",
      tags = ["kubernetes", "postgres", "production", "microservices"],
    },

    services = {
      api = {
        type = 'api,
        image = {
          name = "platform-api",
          tag = "1.0.0",
        },
        ports = [{
          container_port = 8080,
          host_port = 8080,
          protocol = 'tcp,
        }],
        environment = {
          LOG_LEVEL = "info",
          DATABASE_URL = "postgresql://postgres:postgres@postgres-service:5432/platform",
          SERVER_HOST = "0.0.0.0",
          SERVER_PORT = "8080",
          REDIS_URL = "redis://cache-service:6379",
        },
        healthcheck = {
          enabled = true,
          endpoint = "/health",
          interval = 30,
          timeout = 10,
          retries = 3,
          start_period = 30,
        },
        resources = {
          cpu_limit = "1000m",
          cpu_request = "500m",
          memory_limit = "512Mi",
          memory_request = "256Mi",
        },
        depends_on = ["postgres", "cache"],
        replicas = 3,
      },

      worker = {
        type = 'worker,
        image = {
          name = "platform-worker",
          tag = "1.0.0",
        },
        ports = [],
        environment = {
          LOG_LEVEL = "info",
          DATABASE_URL = "postgresql://postgres:postgres@postgres-service:5432/platform",
          REDIS_URL = "redis://cache-service:6379",
          WORKER_QUEUE = "default",
        },
        healthcheck = {
          enabled = false,
        },
        resources = {
          cpu_limit = "500m",
          cpu_request = "250m",
          memory_limit = "256Mi",
          memory_request = "128Mi",
        },
        depends_on = ["postgres", "cache"],
        replicas = 2,
      },

      postgres = {
        type = 'database,
        image = {
          name = "postgres",
          tag = "15-alpine",
        },
        ports = [{
          container_port = 5432,
          host_port = 5432,
          protocol = 'tcp,
        }],
        environment = {
          POSTGRES_USER = "postgres",
          POSTGRES_PASSWORD = "postgres",
          POSTGRES_DB = "platform",
          PGDATA = "/var/lib/postgresql/data/pgdata",
        },
        healthcheck = {
          enabled = true,
          endpoint = "",
          interval = 10,
          timeout = 5,
          retries = 5,
        },
        resources = {
          cpu_limit = "1000m",
          cpu_request = "500m",
          memory_limit = "1Gi",
          memory_request = "512Mi",
        },
        volumes = [
          "postgres-data:/var/lib/postgresql/data",
        ],
        replicas = 1,
      },

      cache = {
        type = 'cache,
        image = {
          name = "redis",
          tag = "7-alpine",
        },
        ports = [{
          container_port = 6379,
          host_port = 6379,
          protocol = 'tcp,
        }],
        environment = {},
        healthcheck = {
          enabled = true,
          endpoint = "",
          interval = 10,
          timeout = 5,
          retries = 3,
        },
        resources = {
          cpu_limit = "500m",
          cpu_request = "250m",
          memory_limit = "512Mi",
          memory_request = "256Mi",
        },
        volumes = [
          "redis-data:/data",
        ],
        replicas = 1,
      },
    },

    database = {
      type = 'postgres,
      postgres = {
        host = "postgres-service",
        port = 5432,
        database = "platform",
        username = "postgres",
        password = "postgres",
        pool_size = 20,
        connection_timeout = 30,
        idle_timeout = 600,
        max_lifetime = 3600,
        ssl_mode = 'prefer,
      },
      migrations_path = "./migrations",
      auto_migrate = false,
    },

    deployment = {
      target = 'kubernetes,
      kubernetes = {
        enabled = true,
        namespace = "production",
        create_namespace = true,
        namespace_config = {
          name = "production",
          labels = {
            environment = "production",
            project = "platform",
          },
        },
        service = {
          type = 'ClusterIP,
          session_affinity = 'ClientIP,
          annotations = {},
        },
        ingress = {
          enabled = true,
          name = "platform-ingress",
          class_name = "nginx",
          rules = [{
            host = "api.example.com",
            http = {
              paths = [{
                path = "/",
                path_type = 'Prefix,
                backend = {
                  service = {
                    name = "api",
                    port = {
                      number = 8080,
                    },
                  },
                },
              }],
            },
          }],
          tls = [{
            hosts = ["api.example.com"],
            secret_name = "platform-tls",
          }],
          annotations = {
            "cert-manager.io/cluster-issuer" = "letsencrypt-prod",
            "nginx.ingress.kubernetes.io/rate-limit" = "100",
          },
        },
        deployment_strategy = {
          type = 'RollingUpdate,
          rolling_update = {
            max_surge = "25%",
            max_unavailable = "25%",
          },
        },
        hpa = {
          enabled = true,
          min_replicas = 3,
          max_replicas = 10,
          target_cpu_utilization = 70,
          target_memory_utilization = 80,
        },
        configmaps = [{
          name = "app-config",
          data = {
            LOG_FORMAT = "json",
            ENVIRONMENT = "production",
          },
        }],
        pod_annotations = {
          "prometheus.io/scrape" = "true",
          "prometheus.io/port" = "9090",
          "prometheus.io/path" = "/metrics",
        },
        pod_labels = {
          app = "platform",
          environment = "production",
        },
        image_pull_secrets = ["registry-credentials"],
        node_selector = {
          "kubernetes.io/os" = "linux",
        },
        tolerations = [],
      },
    },

    storage = {
      kubernetes_pvcs = [
        {
          name = "postgres-pvc",
          access_modes = ['ReadWriteOnce],
          resources = {
            requests = {
              storage = "20Gi",
            },
          },
          storage_class_name = "fast-ssd",
        },
        {
          name = "redis-pvc",
          access_modes = ['ReadWriteOnce],
          resources = {
            requests = {
              storage = "5Gi",
            },
          },
          storage_class_name = "fast-ssd",
        },
      ],
      backup_config = {
        enabled = true,
        schedule = "0 2 * * *",
        retention_days = 30,
        destination = "s3://backups/platform",
      },
    },

    network = {
      kubernetes_policies = [{
        name = "api-network-policy",
        pod_selector = {
          matchLabels = {
            app = "platform",
            component = "api",
          },
        },
        policy_types = ['Ingress, 'Egress],
        ingress = [{
          from = [{
            pod_selector = {
              matchLabels = {
                app = "ingress-nginx",
              },
            },
          }],
          ports = [{
            port = 8080,
            protocol = 'TCP,
          }],
        }],
        egress = [{
          to = [{
            pod_selector = {
              matchLabels = {
                app = "platform",
                component = "postgres",
              },
            },
          }],
          ports = [{
            port = 5432,
            protocol = 'TCP,
          }],
        }],
      }],
    },

    monitoring = {
      prometheus = {
        enabled = true,
        port = 9090,
        image = "prom/prometheus:latest",
        scrape_interval = "15s",
        evaluation_interval = "15s",
        retention = "30d",
        scrape_configs = [{
          job_name = "platform-services",
          static_configs = [{
            targets = ["api:8080", "worker:9090"],
            labels = {
              environment = "production",
            },
          }],
        }],
        storage_path = "/prometheus",
      },
      grafana = {
        enabled = true,
        port = 3000,
        image = "grafana/grafana:latest",
        admin_user = "admin",
        admin_password = "changeme",
        datasources = [{
          name = "Prometheus",
          type = 'prometheus,
          access = 'proxy,
          url = "http://prometheus:9090",
          is_default = true,
        }],
        plugins = [
          "grafana-piechart-panel",
          "grafana-clock-panel",
        ],
      },
      loki = {
        enabled = true,
        port = 3100,
        image = "grafana/loki:latest",
        storage_path = "/loki",
        retention_period = "30d",
      },
      jaeger = {
        enabled = true,
        collector_port = 14268,
        query_port = 16686,
        image = "jaegertracing/all-in-one:latest",
        sampling_strategy = 'probabilistic,
        sampling_param = 0.1,
      },
    },

    security = {
      tls = {
        enabled = true,
        min_version = 'TLSv1.2,
        max_version = 'TLSv1.3,
        verify_client = false,
      },
      kubernetes_secrets = [{
        name = "db-credentials",
        type = 'Opaque,
        string_data = {
          POSTGRES_USER = "postgres",
          POSTGRES_PASSWORD = "postgres",
        },
      }],
      auth = {
        method = 'jwt,
        jwt = {
          secret = "changeme-secret-key",
          algorithm = 'HS256,
          expiry_seconds = 3600,
          issuer = "platform-api",
          audience = ["platform-web", "platform-mobile"],
        },
      },
      rbac = {
        roles = [
          {
            name = "admin",
            permissions = ["*"],
            resources = ["*"],
            actions = ['create, 'read, 'update, 'delete, 'list],
          },
          {
            name = "user",
            permissions = ["read:own", "write:own"],
            resources = ["users", "posts"],
            actions = ['read, 'update],
          },
        ],
        default_role = "user",
        admin_role = "admin",
      },
      security_headers = {
        enable_hsts = true,
        hsts_max_age = 31536000,
        enable_csp = true,
        csp_policy = "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'",
        enable_xss_protection = true,
        enable_frame_options = true,
        frame_options_value = 'DENY,
      },
      cors = {
        enabled = true,
        allowed_origins = ["https://example.com", "https://www.example.com"],
        allowed_methods = ["GET", "POST", "PUT", "DELETE", "OPTIONS"],
        allowed_headers = ["Content-Type", "Authorization"],
        allow_credentials = true,
      },
      rate_limiting = {
        enabled = true,
        requests_per_second = 1000,
        burst_size = 2000,
        strategy = 'user,
      },
    },
  },
}
