Enterprise Cloud &
DevOps Infrastructure.

# Production EKS 1.30 Cluster with Karpenter Autoscaling & Bottlerocket OS
module "eks_cluster" {
  source  = "terraform-aws-modules/eks/aws"
  version = "~> 20.0"

  cluster_name    = "prod-core-cluster-01"
  cluster_version = "1.30"

  vpc_id                   = module.vpc.vpc_id
  subnet_ids               = module.vpc.private_subnets
  control_plane_subnet_ids = module.vpc.intra_subnets

  cluster_endpoint_public_access = false  # Zero public API exposure
  cluster_endpoint_private_access = true

  cluster_addons = {
    coredns    = { most_recent = true }
    kube-proxy = { most_recent = true }
    vpc-cni    = { most_recent = true }
  }

  # Karpenter NodePool Configuration with Spot Fallback (-54% bill)
  karpenter = {
    enable_spot_termination_handler = true
    ami_type                        = "BOTTLEROCKET_x86_64"
    instance_categories             = ["m", "c", "r"]
    capacity_types                  = ["spot", "on-demand"]
    max_cpu_limit                   = 200
    max_memory_limit                = "800Gi"
  }
}

# Zero-Downtime Canary Rollout with Automated Prometheus Metric Analysis
apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: core-api-service
spec:
  replicas: 20
  strategy:
    canary:
      analysis:
        templates:
          - templateName: success-rate-http
        args:
          - name: service-name
            value: core-api-service
      steps:
        - setWeight: 10
        - pause: { duration: 5m }  # Monitor latency & 5xx error spikes
        - setWeight: 30
        - pause: { duration: 10m }
        - setWeight: 60
        - pause: { duration: 5m }
        - setWeight: 100

# GitHub Actions DevSecOps Pipeline: Lint, Trivy Scan, Helm Package
name: DevSecOps Continuous Delivery

on:
  push:
    branches: [main]

jobs:
  build-and-gate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Trivy Container Vulnerability Scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: '${{ secrets.ECR_REGISTRY }}/core-api:${{ github.sha }}'
          exit-code: '1'  # Fail pipeline on Critical CVE
          severity: 'CRITICAL,HIGH'

      - name: GitOps Manifest Update
        run: |
          git clone https://${{ secrets.GITOPS_TOKEN }}@github.com/org/gitops-fleet.git
          cd gitops-fleet/apps/core-api
          sed -i 's/tag: .*/tag: ${{ github.sha }}/' values.yaml
          git commit -am "chore(release): bump core-api to ${{ github.sha }}"
          git push origin main

# Cilium eBPF L7 Zero-Trust Network Policy: Restrict East-West Pod Traffic
apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
  name: restrict-payment-service-l7
spec:
  endpointSelector:
    matchLabels:
      app: payment-gateway
  ingress:
    - fromEndpoints:
        - matchLabels:
            app: checkout-frontend
      toPorts:
        - ports:
            - port: "8080"
              protocol: TCP
          rules:
            http:
              - method: "POST"
                path: "/v1/charges"  # Disallow all other verbs and endpoints