# Backstage.io örnek konfigürasyon
apiVersion: backstage.io/v1alpha1
kind: Component
metadata:
  name: payment-service
  description: Ödeme işleme servisi
  tags:
    - java
    - spring-boot
    - microservice
spec:
  type: service
  lifecycle: production
  owner: platform-team
  system: payment-system
  providesApis:
    - payment-api

# AI destekli anomali tespiti örneği
from prometheus_api_client import PrometheusConnect
import pandas as pd
from sklearn.ensemble import IsolationForest

prom = PrometheusConnect(url="http://prometheus:9090")
metrics = prom.get_current_metric_value(metric_name='api_request_duration')

# AI model ile anomali tespiti
model = IsolationForest(contamination=0.1)
predictions = model.fit_predict(metrics_df)

# GitHub Copilot ile Terraform kodu üretimi
# Prompt: "Create AWS EKS cluster with autoscaling"

resource "aws_eks_cluster" "main" {
  name     = "production-cluster"
  role_arn = aws_iam_role.eks_cluster.arn
  version  = "1.28"

  vpc_config {
    subnet_ids              = aws_subnet.private[*].id
    endpoint_private_access = true
    endpoint_public_access  = true
  }

  enabled_cluster_log_types = [
    "api", "audit", "authenticator",
    "controllerManager", "scheduler"
  ]
}

# OpenCost ile Kubernetes maliyet izleme
apiVersion: v1
kind: ConfigMap
metadata:
  name: opencost-config
data:
  prometheus-server-endpoint: http://prometheus:9090
  cloud-provider-api-key: ${CLOUD_API_KEY}

---
# Cost allocation labels
apiVersion: v1
kind: Pod
metadata:
  labels:
    app: web-server
    cost-center: engineering
    team: platform
    environment: production

# Cloud Carbon Footprint monitoring
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: carbon-footprint
spec:
  endpoints:
    - interval: 30s
      path: /metrics
      port: metrics
  selector:
    matchLabels:
      app: cloud-carbon-footprint

# ArgoCD ApplicationSet - Multi-cluster deployment
apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: microservices-apps
spec:
  generators:
  - git:
      repoURL: https://github.com/tektik/apps.git
      revision: HEAD
      directories:
      - path: services/*
  template:
    metadata:
      name: '{{path.basename}}'
    spec:
      project: default
      source:
        repoURL: https://github.com/tektik/apps.git
        targetRevision: HEAD
        path: '{{path}}'
      destination:
        server: https://kubernetes.default.svc
        namespace: production
      syncPolicy:
        automated:
          prune: true
          selfHeal: true
        syncOptions:
        - CreateNamespace=true

# OPA/Gatekeeper policy örneği
package kubernetes.admission

deny[msg] {
  input.request.kind.kind == "Pod"
  not input.request.object.spec.securityContext.runAsNonRoot
  msg = "Containers must not run as root"
}

deny[msg] {
  input.request.kind.kind == "Deployment"
  not input.request.object.spec.template.spec.containers[_].resources.limits.memory
  msg = "Containers must have memory limits"
}

# Sigstore/Cosign ile container imaj imzalama
name: Build and Sign
on: [push]
jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      packages: write
    steps:
      - name: Build image
        run: docker build -t ghcr.io/tektik/app:${{ github.sha }} .

      - name: Sign image with Cosign
        run: |
          cosign sign --yes ghcr.io/tektik/app:${{ github.sha }}

      - name: Generate SBOM
        run: |
          syft ghcr.io/tektik/app:${{ github.sha }} -o spdx-json > sbom.json

      - name: Sign SBOM
        run: |
          cosign attach sbom --sbom sbom.json ghcr.io/tektik/app:${{ github.sha }}

# Istio ile Zero Trust implementasyonu
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: production
spec:
  mtls:
    mode: STRICT
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: frontend-policy
spec:
  selector:
    matchLabels:
      app: frontend
  action: ALLOW
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/production/sa/api-gateway"]
    to:
    - operation:
        methods: ["GET", "POST"]
        paths: ["/api/*"]

// OpenTelemetry Go SDK örneği
package main

import (
    "go.opentelemetry.io/otel"
    "go.opentelemetry.io/otel/trace"
    "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp"
)

func initTracer() {
    exporter, _ := otlptracehttp.New(
        context.Background(),
        otlptracehttp.WithEndpoint("otel-collector:4318"),
    )

    tp := trace.NewTracerProvider(
        trace.WithBatcher(exporter),
        trace.WithResource(resource.NewWithAttributes(
            semconv.SchemaURL,
            semconv.ServiceName("payment-service"),
            semconv.ServiceVersion("1.0.0"),
        )),
    )

    otel.SetTracerProvider(tp)
}

# Grafana Stack deployment
apiVersion: v1
kind: ConfigMap
metadata:
  name: grafana-datasources
data:
  datasources.yaml: |
    apiVersion: 1
    datasources:
      - name: Prometheus
        type: prometheus
        url: http://prometheus:9090

      - name: Loki
        type: loki
        url: http://loki:3100

      - name: Tempo
        type: tempo
        url: http://tempo:3200

      - name: Mimir
        type: prometheus
        url: http://mimir:9009

apiVersion: tekton.dev/v1beta1
kind: Pipeline
metadata:
  name: build-and-deploy
spec:
  params:
    - name: git-url
    - name: image-name
  workspaces:
    - name: shared-workspace
  tasks:
    - name: fetch-source
      taskRef:
        name: git-clone
      workspaces:
        - name: output
          workspace: shared-workspace
      params:
        - name: url
          value: $(params.git-url)

    - name: run-tests
      runAfter: ["fetch-source"]
      taskRef:
        name: golang-test
      workspaces:
        - name: source
          workspace: shared-workspace

    - name: build-image
      runAfter: ["run-tests"]
      taskRef:
        name: kaniko
      params:
        - name: IMAGE
          value: $(params.image-name)
      workspaces:
        - name: source
          workspace: shared-workspace

    - name: deploy-to-k8s
      runAfter: ["build-image"]
      taskRef:
        name: kubectl-deploy
      params:
        - name: manifest-path
          value: k8s/deployment.yaml

# .github/workflows/deploy.yml
name: Deploy to Production
on:
  push:
    branches: [main]

jobs:
  deploy:
    uses: tektik/workflows/.github/workflows/k8s-deploy.yml@v1
    with:
      environment: production
      cluster: prod-cluster
      namespace: default
    secrets:
      KUBECONFIG: ${{ secrets.PROD_KUBECONFIG }}
      SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}