# SBV ISO 20022 API Gateway — Kubernetes Deployment
# Cơ quan chủ quản: Ngân hàng Nhà nước Việt Nam (SBV)
# Namespace: sbv-gateway
# Phiên bản: 1.0.0
---
apiVersion: v1
kind: Namespace
metadata:
  name: sbv-gateway
  labels:
    app.kubernetes.io/name: sbv-iso20022-gateway
    sbv.gov.vn/env: production

---
# ─── ConfigMap ────────────────────────────────────────────────────────────────
apiVersion: v1
kind: ConfigMap
metadata:
  name: sbv-gateway-config
  namespace: sbv-gateway
data:
  HOST: "0.0.0.0"
  PORT: "8080"
  GOV_CHAIN_ENABLED: "false"        # Set "true" khi Gov-Chain M3 deploy
  KAFKA_ENABLED: "false"            # Set "true" khi Kafka cluster sẵn sàng
  KAFKA_BROKERS: "kafka-headless.kafka:9092"
  GOV_CHAIN_RPC: "http://gov-chain.sbv.gov.vn:8545"
  NODE_ENV: "production"

---
# ─── Secret (OAuth keys, TLS certs — điền qua SealedSecret / Vault) ──────────
# Placeholder: Trong production dùng Vault Agent Injector hoặc External Secrets Operator
apiVersion: v1
kind: Secret
metadata:
  name: sbv-gateway-secret
  namespace: sbv-gateway
  annotations:
    sbv.gov.vn/managed-by: "vault"
type: Opaque
stringData:
  OAUTH_CLIENT_SECRET: "REPLACE_WITH_VAULT_REF"
  HSM_TOKEN_PIN: "REPLACE_WITH_VAULT_REF"

---
# ─── Deployment ───────────────────────────────────────────────────────────────
apiVersion: apps/v1
kind: Deployment
metadata:
  name: sbv-iso20022-gateway
  namespace: sbv-gateway
  labels:
    app: sbv-iso20022-gateway
    version: "1.0.0"
spec:
  replicas: 3                       # HA: 3 replicas → uptime 99.99%
  selector:
    matchLabels:
      app: sbv-iso20022-gateway
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0             # Zero-downtime deployment
  template:
    metadata:
      labels:
        app: sbv-iso20022-gateway
        version: "1.0.0"
    spec:
      serviceAccountName: sbv-gateway-sa
      securityContext:
        runAsNonRoot: true
        runAsUser: 1001
        fsGroup: 1001
      containers:
        - name: gateway
          image: registry.sbv.gov.vn/iso20022-gateway:1.0.0
          imagePullPolicy: Always
          ports:
            - name: http
              containerPort: 8080
              protocol: TCP
          envFrom:
            - configMapRef:
                name: sbv-gateway-config
            - secretRef:
                name: sbv-gateway-secret
          resources:
            requests:
              cpu: "500m"
              memory: "512Mi"
            limits:
              cpu: "2000m"
              memory: "2Gi"
          livenessProbe:
            httpGet:
              path: /api/v1/iso20022/health
              port: 8080
            initialDelaySeconds: 10
            periodSeconds: 15
            failureThreshold: 3
          readinessProbe:
            httpGet:
              path: /api/v1/iso20022/health
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 10
          volumeMounts:
            - name: tls-certs
              mountPath: /etc/ssl/sbv
              readOnly: true
            - name: log-volume
              mountPath: /app/gateway.log
              subPath: gateway.log
      volumes:
        - name: tls-certs
          secret:
            secretName: sbv-gateway-tls
        - name: log-volume
          persistentVolumeClaim:
            claimName: sbv-gateway-logs-pvc
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: kubernetes.io/hostname
          whenUnsatisfiable: DoNotSchedule
          labelSelector:
            matchLabels:
              app: sbv-iso20022-gateway

---
# ─── Service ──────────────────────────────────────────────────────────────────
apiVersion: v1
kind: Service
metadata:
  name: sbv-iso20022-gateway
  namespace: sbv-gateway
  labels:
    app: sbv-iso20022-gateway
spec:
  type: ClusterIP
  selector:
    app: sbv-iso20022-gateway
  ports:
    - name: http
      port: 80
      targetPort: 8080
      protocol: TCP

---
# ─── Horizontal Pod Autoscaler (SLA: 5,000 TPS peak 10,000 TPS) ──────────────
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: sbv-iso20022-gateway-hpa
  namespace: sbv-gateway
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: sbv-iso20022-gateway
  minReplicas: 3
  maxReplicas: 20
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 60
    - type: Resource
      resource:
        name: memory
        target:
          type: Utilization
          averageUtilization: 70

---
# ─── PodDisruptionBudget (đảm bảo uptime trong maintenance) ──────────────────
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: sbv-gateway-pdb
  namespace: sbv-gateway
spec:
  minAvailable: 2
  selector:
    matchLabels:
      app: sbv-iso20022-gateway

---
# ─── ServiceAccount ───────────────────────────────────────────────────────────
apiVersion: v1
kind: ServiceAccount
metadata:
  name: sbv-gateway-sa
  namespace: sbv-gateway
  annotations:
    sbv.gov.vn/role: "gateway"

---
# ─── Ingress (TLS 1.3 + mTLS termination) ────────────────────────────────────
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: sbv-iso20022-gateway-ingress
  namespace: sbv-gateway
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
    nginx.ingress.kubernetes.io/ssl-protocols: "TLSv1.3 TLSv1.2"
    nginx.ingress.kubernetes.io/ssl-ciphers: "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256"
    nginx.ingress.kubernetes.io/auth-tls-verify-client: "on"
    nginx.ingress.kubernetes.io/auth-tls-secret: "sbv-gateway/sbv-ca-cert"
    nginx.ingress.kubernetes.io/auth-tls-verify-depth: "2"
    nginx.ingress.kubernetes.io/proxy-body-size: "2m"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "30"
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - api.iso20022.sbv.gov.vn
      secretName: sbv-gateway-tls
  rules:
    - host: api.iso20022.sbv.gov.vn
      http:
        paths:
          - path: /api/v1/iso20022
            pathType: Prefix
            backend:
              service:
                name: sbv-iso20022-gateway
                port:
                  name: http
