twelve_factors:
  1_codebase:
    principle: "One codebase tracked in revision control, many deploys"
    implementation:
      - git_repository: "single source of truth"
      - branching_strategy: "GitFlow or GitHub Flow"
      - environment_parity: "dev, staging, prod from same codebase"

  2_dependencies:
    principle: "Explicitly declare and isolate dependencies"
    implementation:
      - package_managers: ["npm", "pip", "maven", "gradle"]
      - containerization: "include all dependencies in container"
      - no_system_dependencies: "avoid relying on system packages"

  3_config:
    principle: "Store config in the environment"
    implementation:
      - environment_variables: true
      - config_maps: "Kubernetes ConfigMaps"
      - secrets_management: "External secret stores"
      - no_hardcoded_values: true

  4_backing_services:
    principle: "Treat backing services as attached resources"
    implementation:
      - service_discovery: "DNS or service mesh"
      - connection_strings: "environment variables"
      - loose_coupling: "easily swap services"

  5_build_release_run:
    principle: "Strictly separate build and run stages"
    implementation:
      - ci_cd_pipeline: "automated builds"
      - immutable_releases: "versioned artifacts"
      - rollback_capability: "quick reversion"

  6_processes:
    principle: "Execute the app as one or more stateless processes"
    implementation:
      - stateless_design: "no sticky sessions"
      - external_state: "databases, caches"
      - horizontal_scaling: "add more instances"

  7_port_binding:
    principle: "Export services via port binding"
    implementation:
      - self_contained: "embedded web server"
      - port_configuration: "environment variable"
      - service_mesh: "automatic port management"

  8_concurrency:
    principle: "Scale out via the process model"
    implementation:
      - process_types: "web, worker, scheduled"
      - horizontal_scaling: "multiple instances"
      - load_balancing: "distribute traffic"

  9_disposability:
    principle: "Maximize robustness with fast startup and graceful shutdown"
    implementation:
      - fast_startup: "<10 seconds"
      - graceful_shutdown: "handle SIGTERM"
      - crash_recovery: "automatic restart"

  10_dev_prod_parity:
    principle: "Keep development, staging, and production as similar as possible"
    implementation:
      - containerization: "same everywhere"
      - infrastructure_as_code: "identical environments"
      - continuous_deployment: "minimize time gap"

  11_logs:
    principle: "Treat logs as event streams"
    implementation:
      - stdout_stderr: "write to standard streams"
      - log_aggregation: "centralized logging"
      - structured_logging: "JSON format"

  12_admin_processes:
    principle: "Run admin/management tasks as one-off processes"
    implementation:
      - database_migrations: "separate process"
      - console_access: "kubectl exec"
      - job_scheduling: "Kubernetes Jobs"

class CloudNativePatterns:
    def __init__(self):
        self.patterns = {}

    def implement_circuit_breaker(self):
        """Circuit breaker pattern for fault tolerance"""

        circuit_breaker_config = {
            'failure_threshold': 5,
            'timeout': 60,  # seconds
            'half_open_requests': 3,
            'states': {
                'closed': 'normal operation',
                'open': 'fast fail',
                'half_open': 'testing recovery'
            },
            'implementation': '''
            class CircuitBreaker:
                def __init__(self, failure_threshold=5, timeout=60):
                    self.failure_threshold = failure_threshold
                    self.timeout = timeout
                    self.failure_count = 0
                    self.last_failure_time = None
                    self.state = 'closed'

                def call(self, func, *args, **kwargs):
                    if self.state == 'open':
                        if time.time() - self.last_failure_time > self.timeout:
                            self.state = 'half_open'
                        else:
                            raise Exception("Circuit breaker is open")

                    try:
                        result = func(*args, **kwargs)
                        if self.state == 'half_open':
                            self.state = 'closed'
                            self.failure_count = 0
                        return result
                    except Exception as e:
                        self.failure_count += 1
                        self.last_failure_time = time.time()
                        if self.failure_count >= self.failure_threshold:
                            self.state = 'open'
                        raise e
            '''
        }

        return circuit_breaker_config

    def implement_saga_pattern(self):
        """Saga pattern for distributed transactions"""

        saga_pattern = {
            'type': 'choreography',
            'steps': [
                {
                    'service': 'order-service',
                    'action': 'create_order',
                    'compensating_action': 'cancel_order',
                    'events': {
                        'success': 'OrderCreated',
                        'failure': 'OrderFailed'
                    }
                },
                {
                    'service': 'payment-service',
                    'action': 'process_payment',
                    'compensating_action': 'refund_payment',
                    'events': {
                        'success': 'PaymentProcessed',
                        'failure': 'PaymentFailed'
                    }
                },
                {
                    'service': 'inventory-service',
                    'action': 'reserve_items',
                    'compensating_action': 'release_items',
                    'events': {
                        'success': 'ItemsReserved',
                        'failure': 'ItemsUnavailable'
                    }
                }
            ],
            'error_handling': {
                'retry_policy': {
                    'max_attempts': 3,
                    'backoff': 'exponential'
                },
                'compensation_trigger': 'any_step_failure'
            }
        }

        return saga_pattern

microservices_principles:
  domain_driven_design:
    bounded_contexts:
      - user_management
      - order_processing
      - inventory_management
      - payment_processing

    context_mapping:
      shared_kernel: ["common data models", "shared libraries"]
      customer_supplier: ["upstream/downstream relationships"]
      conformist: ["accept external models"]
      anti_corruption_layer: ["translate between contexts"]

  service_characteristics:
    size: "2-pizza team rule"
    ownership: "full lifecycle ownership"
    data: "service owns its data"
    communication: "API-first design"
    deployment: "independent deployment"

  api_design:
    style: "RESTful or gRPC"
    versioning: "URL or header based"
    documentation: "OpenAPI/Swagger"
    backward_compatibility: "mandatory"
    rate_limiting: "per-client limits"

class ServiceDecomposition:
    def __init__(self, monolith_analysis):
        self.monolith = monolith_analysis

    def identify_service_boundaries(self):
        """Identify microservice boundaries from monolith"""

        decomposition_strategy = {
            'approaches': {
                'by_business_capability': {
                    'services': [
                        {
                            'name': 'customer-service',
                            'capabilities': ['user registration', 'profile management', 'authentication'],
                            'data': ['users', 'profiles', 'sessions'],
                            'apis': ['/api/users', '/api/auth', '/api/profiles']
                        },
                        {
                            'name': 'order-service',
                            'capabilities': ['order creation', 'order tracking', 'order history'],
                            'data': ['orders', 'order_items', 'order_status'],
                            'apis': ['/api/orders', '/api/tracking']
                        },
                        {
                            'name': 'inventory-service',
                            'capabilities': ['stock management', 'availability check', 'reservations'],
                            'data': ['products', 'inventory', 'reservations'],
                            'apis': ['/api/products', '/api/inventory', '/api/availability']
                        }
                    ]
                },

                'by_subdomain': {
                    'core': ['order-processing', 'payment-processing'],
                    'supporting': ['customer-management', 'inventory-management'],
                    'generic': ['notification', 'reporting', 'authentication']
                },

                'by_data_flow': {
                    'read_heavy': ['product-catalog', 'search-service'],
                    'write_heavy': ['order-service', 'payment-service'],
                    'compute_heavy': ['recommendation-engine', 'analytics-service']
                }
            },

            'decomposition_steps': [
                'identify_bounded_contexts',
                'define_service_interfaces',
                'extract_shared_libraries',
                'implement_service_communication',
                'migrate_data_ownership',
                'implement_distributed_transactions',
                'deploy_independently'
            ]
        }

        return decomposition_strategy

    def implement_strangler_fig_pattern(self):
        """Gradually replace monolith with microservices"""

        migration_phases = [
            {
                'phase': 1,
                'name': 'Parallel Run',
                'duration': '2 months',
                'steps': [
                    'Deploy API Gateway',
                    'Route all traffic through gateway',
                    'Implement logging and monitoring',
                    'Create service extraction framework'
                ]
            },
            {
                'phase': 2,
                'name': 'Extract First Service',
                'duration': '1 month',
                'steps': [
                    'Choose least coupled component',
                    'Extract to separate service',
                    'Implement service communication',
                    'Route specific APIs to new service',
                    'Monitor and validate'
                ]
            },
            {
                'phase': 3,
                'name': 'Incremental Extraction',
                'duration': '6-12 months',
                'steps': [
                    'Extract services by priority',
                    'Implement service mesh',
                    'Migrate data ownership',
                    'Implement distributed patterns',
                    'Continuous validation'
                ]
            },
            {
                'phase': 4,
                'name': 'Monolith Sunset',
                'duration': '1 month',
                'steps': [
                    'Validate all functionality migrated',
                    'Performance testing',
                    'Decommission monolith',
                    'Optimize microservices'
                ]
            }
        ]

        return migration_phases

service_communication:
  synchronous:
    rest_api:
      protocol: "HTTP/HTTPS"
      format: "JSON"
      pros: ["simple", "widely supported", "stateless"]
      cons: ["latency", "tight coupling", "cascade failures"]
      use_cases: ["request-response", "CRUD operations"]

    grpc:
      protocol: "HTTP/2"
      format: "Protocol Buffers"
      pros: ["efficient", "streaming", "type-safe"]
      cons: ["complexity", "limited browser support"]
      use_cases: ["internal services", "high-performance"]

  asynchronous:
    message_queue:
      technologies: ["RabbitMQ", "Amazon SQS", "Azure Service Bus"]
      patterns: ["point-to-point", "publish-subscribe"]
      pros: ["decoupling", "reliability", "scalability"]
      cons: ["complexity", "eventual consistency"]
      use_cases: ["task processing", "event notification"]

    event_streaming:
      technologies: ["Apache Kafka", "Amazon Kinesis", "Azure Event Hubs"]
      patterns: ["event sourcing", "CQRS"]
      pros: ["real-time", "replay capability", "scalability"]
      cons: ["complexity", "storage requirements"]
      use_cases: ["real-time analytics", "event-driven architecture"]

  service_mesh:
    features:
      - traffic_management: ["load balancing", "circuit breaking", "retries"]
      - security: ["mTLS", "authorization", "encryption"]
      - observability: ["tracing", "metrics", "logging"]

    technologies:
      istio:
        components: ["Pilot", "Mixer", "Citadel", "Galley"]
        capabilities: ["advanced traffic management", "policy enforcement"]

      linkerd:
        advantages: ["lightweight", "simple", "fast"]
        use_case: "simple service mesh requirements"

      consul_connect:
        integration: "HashiCorp ecosystem"
        features: ["service discovery", "configuration"]

# Multi-stage Dockerfile example
# Stage 1: Build stage
FROM node:16-alpine AS builder

# Install build dependencies
RUN apk add --no-cache python3 make g++

# Set working directory
WORKDIR /app

# Copy package files
COPY package*.json ./

# Install dependencies
RUN npm ci --only=production

# Copy source code
COPY . .

# Build application
RUN npm run build

# Stage 2: Production stage
FROM node:16-alpine

# Install runtime dependencies only
RUN apk add --no-cache tini

# Create non-root user
RUN addgroup -g 1001 -S nodejs && \
    adduser -S nodejs -u 1001

# Set working directory
WORKDIR /app

# Copy built application from builder stage
COPY --from=builder --chown=nodejs:nodejs /app/dist ./dist
COPY --from=builder --chown=nodejs:nodejs /app/node_modules ./node_modules
COPY --from=builder --chown=nodejs:nodejs /app/package*.json ./

# Expose port
EXPOSE 3000

# Use non-root user
USER nodejs

# Add health check
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
    CMD node healthcheck.js

# Use tini for proper signal handling
ENTRYPOINT ["/sbin/tini", "--"]

# Start application
CMD ["node", "dist/server.js"]

container_security:
  build_time_scanning:
    tools:
      - trivy:
          scan_types: ["vulnerabilities", "misconfigurations", "secrets"]
          severity_threshold: "HIGH"
          ignore_unfixed: false

      - snyk:
          scan_targets: ["dockerfile", "dependencies", "licenses"]
          integration: "CI/CD pipeline"

      - twistlock:
          compliance_checks: ["CIS", "NIST", "PCI"]
          runtime_protection: true

  image_signing:
    tools: ["cosign", "notary"]
    policy: "only signed images in production"
    verification: "admission controller"

  runtime_security:
    capabilities:
      drop: ["ALL"]
      add: ["NET_BIND_SERVICE"]

    security_context:
      runAsNonRoot: true
      runAsUser: 1001
      readOnlyRootFilesystem: true
      allowPrivilegeEscalation: false

    resource_limits:
      memory: "256Mi"
      cpu: "100m"

class ContainerRegistryStrategy:
    def __init__(self):
        self.registries = {
            'development': 'dev-registry.company.com',
            'staging': 'staging-registry.company.com',
            'production': 'prod-registry.company.com'
        }

    def implement_image_promotion(self):
        """Implement image promotion pipeline"""

        promotion_pipeline = {
            'stages': [
                {
                    'name': 'Build',
                    'actions': [
                        'Build container image',
                        'Run security scans',
                        'Run unit tests',
                        'Tag with commit SHA'
                    ],
                    'registry': self.registries['development']
                },
                {
                    'name': 'Test',
                    'actions': [
                        'Deploy to test environment',
                        'Run integration tests',
                        'Run performance tests',
                        'Tag as tested'
                    ],
                    'promotion': {
                        'from': self.registries['development'],
                        'to': self.registries['staging']
                    }
                },
                {
                    'name': 'Staging',
                    'actions': [
                        'Deploy to staging',
                        'Run acceptance tests',
                        'Manual approval',
                        'Tag as approved'
                    ],
                    'promotion': {
                        'from': self.registries['staging'],
                        'to': self.registries['production']
                    }
                }
            ],

            'policies': {
                'retention': {
                    'development': '7 days',
                    'staging': '30 days',
                    'production': '1 year'
                },
                'vulnerability_scanning': {
                    'frequency': 'daily',
                    'action_on_critical': 'quarantine'
                }
            }
        }

        return promotion_pipeline

# Kubernetes deployment example
apiVersion: apps/v1
kind: Deployment
metadata:
  name: user-service
  labels:
    app: user-service
    version: v1
spec:
  replicas: 3
  selector:
    matchLabels:
      app: user-service
  template:
    metadata:
      labels:
        app: user-service
        version: v1
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "8080"
        prometheus.io/path: "/metrics"
    spec:
      serviceAccountName: user-service
      containers:
      - name: user-service
        image: myregistry/user-service:1.0.0
        ports:
        - containerPort: 8080
          name: http
        - containerPort: 8081
          name: metrics
        env:
        - name: DATABASE_URL
          valueFrom:
            secretKeyRef:
              name: database-secret
              key: url
        - name: LOG_LEVEL
          value: "info"
        resources:
          requests:
            memory: "128Mi"
            cpu: "100m"
          limits:
            memory: "256Mi"
            cpu: "200m"
        livenessProbe:
          httpGet:
            path: /health/live
            port: 8080
          initialDelaySeconds: 30
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /health/ready
            port: 8080
          initialDelaySeconds: 5
          periodSeconds: 5
        securityContext:
          runAsNonRoot: true
          runAsUser: 1001
          readOnlyRootFilesystem: true
          capabilities:
            drop:
            - ALL
        volumeMounts:
        - name: tmp
          mountPath: /tmp
        - name: cache
          mountPath: /app/cache
      volumes:
      - name: tmp
        emptyDir: {}
      - name: cache
        emptyDir: {}
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            podAffinityTerm:
              labelSelector:
                matchExpressions:
                - key: app
                  operator: In
                  values:
                  - user-service
              topologyKey: kubernetes.io/hostname
---
apiVersion: v1
kind: Service
metadata:
  name: user-service
  labels:
    app: user-service
spec:
  type: ClusterIP
  ports:
  - port: 80
    targetPort: 8080
    protocol: TCP
    name: http
  selector:
    app: user-service
---
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: user-service-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: user-service
  minReplicas: 3
  maxReplicas: 10
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70
  - type: Resource
    resource:
      name: memory
      target:
        type: Utilization
        averageUtilization: 80
  - type: Pods
    pods:
      metric:
        name: http_requests_per_second
      target:
        type: AverageValue
        averageValue: "1000"

class KubernetesPatterns:
    def __init__(self):
        self.patterns = {}

    def implement_sidecar_pattern(self):
        """Implement sidecar container pattern"""

        sidecar_examples = {
            'logging_sidecar': {
                'purpose': 'Ship logs to centralized logging',
                'implementation': '''
apiVersion: v1
kind: Pod
metadata:
  name: app-with-logging
spec:
  containers:
  - name: app
    image: myapp:latest
    volumeMounts:
    - name: shared-logs
      mountPath: /var/log
  - name: log-shipper
    image: fluentd:latest
    volumeMounts:
    - name: shared-logs
      mountPath: /var/log
    - name: fluentd-config
      mountPath: /fluentd/etc
  volumes:
  - name: shared-logs
    emptyDir: {}
  - name: fluentd-config
    configMap:
      name: fluentd-config
                '''
            },

            'service_mesh_proxy': {
                'purpose': 'Handle service communication',
                'implementation': 'Automatic injection by Istio/Linkerd'
            },

            'security_proxy': {
                'purpose': 'OAuth/authentication proxy',
                'example': 'oauth2-proxy sidecar'
            }
        }

        return sidecar_examples

    def implement_init_container_pattern(self):
        """Init container for setup tasks"""

        init_container_config = '''
apiVersion: v1
kind: Pod
metadata:
  name: app-with-init
spec:
  initContainers:
  - name: migration
    image: migrate:latest
    command: ['./migrate.sh']
    env:
    - name: DATABASE_URL
      valueFrom:
        secretKeyRef:
          name: database-secret
          key: url
  - name: cache-warmer
    image: cache-warmer:latest
    command: ['./warm-cache.sh']
  containers:
  - name: app
    image: myapp:latest
    ports:
    - containerPort: 8080
        '''

        return init_container_config

// Custom Operator example in Go
package main

import (
    "context"
    "fmt"

    corev1 "k8s.io/api/core/v1"
    "k8s.io/apimachinery/pkg/runtime"
    ctrl "sigs.k8s.io/controller-runtime"
    "sigs.k8s.io/controller-runtime/pkg/client"
    "sigs.k8s.io/controller-runtime/pkg/log"
)

// ApplicationReconciler reconciles a Application object
type ApplicationReconciler struct {
    client.Client
    Scheme *runtime.Scheme
}

// Reconcile handles the reconciliation loop
func (r *ApplicationReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
    log := log.FromContext(ctx)

    // Fetch the Application instance
    var app Application
    if err := r.Get(ctx, req.NamespacedName, &app); err != nil {
        return ctrl.Result{}, client.IgnoreNotFound(err)
    }

    // Create or update Deployment
    deployment := r.deploymentForApp(&app)
    if err := r.Create(ctx, deployment); err != nil {
        log.Error(err, "Failed to create Deployment")
        return ctrl.Result{}, err
    }

    // Create or update Service
    service := r.serviceForApp(&app)
    if err := r.Create(ctx, service); err != nil {
        log.Error(err, "Failed to create Service")
        return ctrl.Result{}, err
    }

    // Update status
    app.Status.Ready = true
    if err := r.Status().Update(ctx, &app); err != nil {
        log.Error(err, "Failed to update Application status")
        return ctrl.Result{}, err
    }

    return ctrl.Result{}, nil
}

gitops_configuration:
  principles:
    - declarative: "Everything defined as code"
    - versioned: "Git as single source of truth"
    - automated: "Automated synchronization"
    - observable: "Clear audit trail"

  tools:
    argocd:
      features:
        - automated_sync: true
        - self_healing: true
        - multi_cluster: true
        - rbac: true

      application_example:
        apiVersion: argoproj.io/v1alpha1
        kind: Application
        metadata:
          name: user-service
          namespace: argocd
        spec:
          project: default
          source:
            repoURL: https://github.com/company/k8s-configs
            targetRevision: HEAD
            path: services/user-service
          destination:
            server: https://kubernetes.default.svc
            namespace: production
          syncPolicy:
            automated:
              prune: true
              selfHeal: true
            syncOptions:
            - CreateNamespace=true

    flux:
      version: "v2"
      components:
        - source_controller
        - kustomize_controller
        - helm_controller
        - notification_controller

// Jenkinsfile example
pipeline {
    agent {
        kubernetes {
            yaml '''
apiVersion: v1
kind: Pod
spec:
  containers:
  - name: docker
    image: docker:latest
    command: ['cat']
    tty: true
    volumeMounts:
    - name: docker-sock
      mountPath: /var/run/docker.sock
  - name: kubectl
    image: bitnami/kubectl:latest
    command: ['cat']
    tty: true
  - name: helm
    image: alpine/helm:latest
    command: ['cat']
    tty: true
  volumes:
  - name: docker-sock
    hostPath:
      path: /var/run/docker.sock
'''
        }
    }

    environment {
        REGISTRY = 'myregistry.com'
        APP_NAME = 'user-service'
        GIT_COMMIT_SHORT = sh(script: "printf \$(git rev-parse --short HEAD)", returnStdout: true)
    }

    stages {
        stage('Build') {
            steps {
                container('docker') {
                    sh """
                        docker build -t ${REGISTRY}/${APP_NAME}:${GIT_COMMIT_SHORT} .
                        docker tag ${REGISTRY}/${APP_NAME}:${GIT_COMMIT_SHORT} ${REGISTRY}/${APP_NAME}:latest
                    """
                }
            }
        }

        stage('Test') {
            parallel {
                stage('Unit Tests') {
                    steps {
                        sh 'npm test'
                    }
                }

                stage('Security Scan') {
                    steps {
                        sh 'trivy image ${REGISTRY}/${APP_NAME}:${GIT_COMMIT_SHORT}'
                    }
                }

                stage('Code Quality') {
                    steps {
                        withSonarQubeEnv('sonarqube') {
                            sh 'npm run sonar'
                        }
                    }
                }
            }
        }

        stage('Push') {
            steps {
                container('docker') {
                    withCredentials([usernamePassword(credentialsId: 'registry-creds', usernameVariable: 'USER', passwordVariable: 'PASS')]) {
                        sh """
                            docker login -u ${USER} -p ${PASS} ${REGISTRY}
                            docker push ${REGISTRY}/${APP_NAME}:${GIT_COMMIT_SHORT}
                            docker push ${REGISTRY}/${APP_NAME}:latest
                        """
                    }
                }
            }
        }

        stage('Deploy to Dev') {
            steps {
                container('helm') {
                    sh """
                        helm upgrade --install ${APP_NAME} ./charts/${APP_NAME} \
                            --namespace dev \
                            --set image.tag=${GIT_COMMIT_SHORT} \
                            --wait
                    """
                }
            }
        }

        stage('Integration Tests') {
            steps {
                sh 'npm run test:integration'
            }
        }

        stage('Deploy to Staging') {
            when {
                branch 'main'
            }
            steps {
                container('helm') {
                    sh """
                        helm upgrade --install ${APP_NAME} ./charts/${APP_NAME} \
                            --namespace staging \
                            --set image.tag=${GIT_COMMIT_SHORT} \
                            --wait
                    """
                }
            }
        }

        stage('Deploy to Production') {
            when {
                branch 'main'
            }
            input {
                message "Deploy to production?"
                ok "Deploy"
            }
            steps {
                container('helm') {
                    sh """
                        helm upgrade --install ${APP_NAME} ./charts/${APP_NAME} \
                            --namespace production \
                            --set image.tag=${GIT_COMMIT_SHORT} \
                            --set replicaCount=5 \
                            --wait
                    """
                }
            }
        }
    }

    post {
        always {
            cleanWs()
        }
        success {
            slackSend(color: 'good', message: "Deployment successful: ${APP_NAME}:${GIT_COMMIT_SHORT}")
        }
        failure {
            slackSend(color: 'danger', message: "Deployment failed: ${APP_NAME}:${GIT_COMMIT_SHORT}")
        }
    }
}

observability_stack:
  metrics:
    collection:
      prometheus:
        scrape_interval: 15s
        retention: 15d
        remote_write:
          - url: "https://thanos-gateway:19291/api/v1/receive"

    instrumentation:
      - method: "client_libraries"
        languages: ["go", "java", "python", "nodejs"]
      - method: "service_mesh"
        automatic: true

    visualization:
      grafana:
        datasources:
          - prometheus
          - thanos
        dashboards:
          - kubernetes_cluster
          - application_metrics
          - business_metrics

  logging:
    collection:
      fluentd:
        inputs:
          - container_logs
          - application_logs
          - system_logs

        filters:
          - multiline_parsing
          - field_extraction
          - enrichment

        outputs:
          - elasticsearch
          - s3_archive

    storage:
      elasticsearch:
        retention: "30 days"
        index_pattern: "logs-%{+YYYY.MM.dd}"
        replicas: 1

    analysis:
      kibana:
        features:
          - log_search
          - dashboards
          - alerts

  tracing:
    collection:
      opentelemetry:
        receivers:
          - otlp
          - jaeger
          - zipkin

        processors:
          - batch
          - sampling
          - attributes

        exporters:
          - jaeger
          - prometheus

    storage:
      jaeger:
        backend: "elasticsearch"
        sampling_rate: 0.001

    analysis:
      jaeger_ui:
        features:
          - trace_search
          - service_dependencies
          - performance_analysis

class ObservabilityImplementation:
    def __init__(self):
        self.components = {}

    def implement_distributed_tracing(self):
        """Implement distributed tracing across services"""

        tracing_config = {
            'instrumentation': '''
from opentelemetry import trace
from opentelemetry.exporter.jaeger import JaegerExporter
from opentelemetry.sdk.trace import TracerProvider
from opentelemetry.sdk.trace.export import BatchSpanProcessor
from opentelemetry.instrumentation.flask import FlaskInstrumentor
from opentelemetry.instrumentation.requests import RequestsInstrumentor

# Configure tracer
trace.set_tracer_provider(TracerProvider())
tracer = trace.get_tracer(__name__)

# Configure Jaeger exporter
jaeger_exporter = JaegerExporter(
    agent_host_name="jaeger-agent",
    agent_port=6831,
)

# Add batch processor
span_processor = BatchSpanProcessor(jaeger_exporter)
trace.get_tracer_provider().add_span_processor(span_processor)

# Auto-instrument frameworks
FlaskInstrumentor().instrument()
RequestsInstrumentor().instrument()

# Manual instrumentation example
@app.route('/api/users/<user_id>')
def get_user(user_id):
    with tracer.start_as_current_span("get_user") as span:
        span.set_attribute("user.id", user_id)

        # Database call
        with tracer.start_as_current_span("database_query"):
            user = db.get_user(user_id)

        # External service call
        with tracer.start_as_current_span("enrich_user_data"):
            enriched = external_service.enrich(user)

        return jsonify(enriched)
            ''',

            'correlation': {
                'trace_id_header': 'X-Trace-ID',
                'span_id_header': 'X-Span-ID',
                'parent_span_header': 'X-Parent-Span-ID'
            },

            'sampling': {
                'strategy': 'adaptive',
                'rules': [
                    {'service': 'critical-service', 'sample_rate': 1.0},
                    {'endpoint': '/health', 'sample_rate': 0.0},
                    {'default': 0.001}
                ]
            }
        }

        return tracing_config

    def implement_slo_monitoring(self):
        """Implement SLO monitoring and alerting"""

        slo_config = {
            'slis': [
                {
                    'name': 'availability',
                    'description': 'Service availability',
                    'query': 'sum(rate(http_requests_total{status!~"5.."}[5m])) / sum(rate(http_requests_total[5m]))',
                    'unit': 'ratio'
                },
                {
                    'name': 'latency',
                    'description': '95th percentile latency',
                    'query': 'histogram_quantile(0.95, rate(http_request_duration_seconds_bucket[5m]))',
                    'unit': 'seconds'
                }
            ],

            'slos': [
                {
                    'name': 'availability_slo',
                    'sli': 'availability',
                    'target': 0.999,
                    'window': '30d'
                },
                {
                    'name': 'latency_slo',
                    'sli': 'latency',
                    'target': 0.5,
                    'window': '30d'
                }
            ],

            'error_budgets': [
                {
                    'slo': 'availability_slo',
                    'alert_threshold': 0.5,
                    'actions': ['page_oncall', 'freeze_deployments']
                }
            ]
        }

        return slo_config

data_patterns:
  event_sourcing:
    description: "Store state changes as events"
    components:
      event_store:
        technologies: ["Apache Kafka", "Amazon Kinesis", "Azure Event Hubs"]
        retention: "infinite or time-based"

      event_schema:
        format: "Avro or Protocol Buffers"
        registry: "Schema Registry"
        evolution: "backward compatible"

      projection:
        read_models: ["materialized views", "CQRS query side"]
        rebuild: "from event history"

    benefits:
      - audit_trail: "complete history"
      - temporal_queries: "state at any point"
      - debugging: "replay events"

  cqrs:
    description: "Separate read and write models"
    write_side:
      storage: "Event store"
      api: "Commands"
      consistency: "Strong"

    read_side:
      storage: "Optimized read stores"
      api: "Queries"
      consistency: "Eventual"

    synchronization:
      method: "Event projection"
      lag: "< 1 second typical"

  database_per_service:
    principles:
      - service_owns_data: "No shared databases"
      - api_access_only: "No direct database access"
      - polyglot_persistence: "Right tool for the job"

    data_synchronization:
      patterns:
        - saga: "Distributed transactions"
        - event_driven: "Eventually consistent"
        - cdc: "Change data capture"

class DataMigrationStrategy:
    def __init__(self):
        self.strategies = {}

    def implement_dual_write_pattern(self):
        """Dual write pattern for zero-downtime migration"""

        dual_write_phases = [
            {
                'phase': 'Dual Write',
                'duration': '2 weeks',
                'implementation': '''
class DualWriteRepository:
    def __init__(self, old_db, new_db):
        self.old_db = old_db
        self.new_db = new_db
        self.migration_mode = 'DUAL_WRITE'

    def save(self, entity):
        # Write to both databases
        try:
            self.old_db.save(entity)
            self.new_db.save(entity)
        except NewDBException as e:
            # Log but don't fail
            logger.error(f"New DB write failed: {e}")
            # Continue with old DB only

    def find(self, id):
        # Read from old DB primarily
        if self.migration_mode == 'DUAL_WRITE':
            return self.old_db.find(id)
        elif self.migration_mode == 'SHADOW_READ':
            # Compare results
            old_result = self.old_db.find(id)
            new_result = self.new_db.find(id)
            if old_result != new_result:
                logger.warning(f"Data mismatch for id: {id}")
            return old_result
        elif self.migration_mode == 'NEW_PRIMARY':
            return self.new_db.find(id)
                '''
            },
            {
                'phase': 'Shadow Read',
                'duration': '1 week',
                'description': 'Read from both, compare results'
            },
            {
                'phase': 'Switch Primary',
                'duration': '1 day',
                'description': 'New DB becomes primary'
            },
            {
                'phase': 'Cleanup',
                'duration': '1 week',
                'description': 'Remove old DB references'
            }
        ]

        return dual_write_phases

zero_trust_implementation:
  principles:
    - never_trust: "Always verify"
    - least_privilege: "Minimal access"
    - assume_breach: "Defense in depth"

  components:
    identity:
      authentication:
        - mTLS: "Service-to-service"
        - OIDC: "User authentication"
        - API_keys: "External clients"

      authorization:
        - RBAC: "Role-based access"
        - ABAC: "Attribute-based access"
        - OPA: "Policy as code"

    network:
      microsegmentation:
        - network_policies: "Kubernetes NetworkPolicy"
        - service_mesh: "Istio/Linkerd policies"
        - calico: "Advanced network policies"

      encryption:
        - in_transit: "TLS everywhere"
        - at_rest: "Encrypted storage"
        - key_management: "KMS integration"

    workload:
      admission_control:
        - pod_security_policies: "Deprecated"
        - pod_security_standards: "New approach"
        - OPA_gatekeeper: "Policy enforcement"

      runtime_security:
        - falco: "Anomaly detection"
        - seccomp: "System call filtering"
        - apparmor: "Application profiles"

class ContainerSecurity:
    def __init__(self):
        self.security_policies = {}

    def implement_pod_security_standards(self):
        """Implement Kubernetes Pod Security Standards"""

        security_levels = {
            'privileged': {
                'description': 'Unrestricted policy',
                'use_case': 'System-level workloads only',
                'namespace_labels': {
                    'pod-security.kubernetes.io/enforce': 'privileged',
                    'pod-security.kubernetes.io/audit': 'privileged',
                    'pod-security.kubernetes.io/warn': 'privileged'
                }
            },

            'baseline': {
                'description': 'Minimally restrictive policy',
                'restrictions': [
                    'No privileged pods',
                    'No host namespaces',
                    'No host ports',
                    'No host path volumes'
                ],
                'namespace_labels': {
                    'pod-security.kubernetes.io/enforce': 'baseline',
                    'pod-security.kubernetes.io/audit': 'restricted',
                    'pod-security.kubernetes.io/warn': 'restricted'
                }
            },

            'restricted': {
                'description': 'Heavily restricted policy',
                'restrictions': [
                    'All baseline restrictions',
                    'No root users',
                    'No privilege escalation',
                    'Seccomp profile required',
                    'Capabilities dropped'
                ],
                'pod_spec': '''
apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    fsGroup: 2000
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: app
    image: myapp:latest
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop:
        - ALL
      runAsNonRoot: true
      runAsUser: 1000
                '''
            }
        }

        return security_levels

transformation_assessment:
  current_state_analysis:
    application_inventory:
      - identify_all_applications
      - document_dependencies
      - assess_complexity
      - measure_technical_debt

    technology_stack:
      - programming_languages
      - frameworks
      - databases
      - infrastructure

    team_skills:
      - current_expertise
      - skill_gaps
      - training_needs

    business_constraints:
      - budget
      - timeline
      - risk_tolerance
      - compliance_requirements

  transformation_strategy:
    approaches:
      rehost:
        description: "Lift and shift with containerization"
        effort: "Low"
        benefits: "Quick wins, learning"
        suitable_for: ["Simple applications", "Low coupling"]

      replatform:
        description: "Minimal changes for cloud optimization"
        effort: "Medium"
        benefits: "Some cloud benefits"
        suitable_for: ["Database migrations", "Managed services"]

      refactor:
        description: "Full cloud-native transformation"
        effort: "High"
        benefits: "Maximum cloud benefits"
        suitable_for: ["Core business applications", "High value"]

    prioritization_matrix:
      high_value_low_effort:
        - "Stateless web applications"
        - "Batch processing jobs"
        - "Read-heavy services"

      high_value_high_effort:
        - "Core business services"
        - "Complex monoliths"
        - "Stateful applications"

      low_value_low_effort:
        - "Internal tools"
        - "Simple APIs"
        - "Static websites"

      low_value_high_effort:
        - "Legacy systems near EOL"
        - "Rarely used applications"

class TransformationRoadmap:
    def __init__(self):
        self.phases = []

    def create_transformation_phases(self):
        """Create detailed transformation phases"""

        phases = [
            {
                'phase': 1,
                'name': 'Foundation',
                'duration': '3 months',
                'objectives': [
                    'Establish cloud-native platform',
                    'Create CI/CD pipelines',
                    'Implement observability',
                    'Train team'
                ],
                'deliverables': [
                    'Kubernetes cluster',
                    'Container registry',
                    'CI/CD pipeline',
                    'Monitoring stack',
                    'First containerized app'
                ],
                'success_criteria': {
                    'platform_ready': True,
                    'team_trained': 80,  # percentage
                    'pilot_app_deployed': True
                }
            },

            {
                'phase': 2,
                'name': 'Pilot Migration',
                'duration': '3 months',
                'objectives': [
                    'Migrate 2-3 pilot applications',
                    'Establish patterns',
                    'Validate architecture',
                    'Measure benefits'
                ],
                'deliverables': [
                    'Migrated applications',
                    'Architecture patterns',
                    'Runbooks',
                    'Metrics dashboard'
                ],
                'success_criteria': {
                    'apps_migrated': 3,
                    'availability': 99.9,
                    'deployment_frequency': 'daily'
                }
            },

            {
                'phase': 3,
                'name': 'Scale Migration',
                'duration': '6-12 months',
                'objectives': [
                    'Migrate majority of applications',
                    'Implement service mesh',
                    'Advanced patterns',
                    'Optimize operations'
                ],
                'deliverables': [
                    '80% apps migrated',
                    'Service mesh deployed',
                    'Automated operations',
                    'Cost optimization'
                ],
                'success_criteria': {
                    'migration_percentage': 80,
                    'mttr': '<30 minutes',
                    'deployment_frequency': 'on-demand',
                    'cost_reduction': 30
                }
            },

            {
                'phase': 4,
                'name': 'Optimization',
                'duration': 'Ongoing',
                'objectives': [
                    'Complete migration',
                    'Optimize performance',
                    'Implement advanced features',
                    'Innovation'
                ],
                'deliverables': [
                    '100% cloud-native',
                    'ML/AI integration',
                    'Advanced automation',
                    'Business innovation'
                ],
                'success_criteria': {
                    'fully_cloud_native': True,
                    'innovation_velocity': 'high',
                    'operational_excellence': True
                }
            }
        ]

        return phases

cloud_native_metrics:
  technical_metrics:
    deployment:
      frequency: "Multiple per day"
      lead_time: "< 1 hour"
      mttr: "< 30 minutes"
      change_failure_rate: "< 5%"

    reliability:
      availability: "> 99.95%"
      error_rate: "< 0.1%"
      latency_p99: "< 200ms"
      throughput: "> 10K RPS"

    efficiency:
      resource_utilization: "> 70%"
      auto_scaling_effectiveness: "> 90%"
      container_density: "> 10 per node"

  business_metrics:
    time_to_market:
      feature_delivery: "50% faster"
      experimentation: "10x more"

    cost:
      infrastructure: "30% reduction"
      operations: "50% reduction"
      development: "20% more efficient"

    quality:
      defect_rate: "50% reduction"
      customer_satisfaction: "> 4.5/5"
      innovation_index: "High"

  cultural_metrics:
    team:
      autonomy: "High"
      ownership: "Full lifecycle"
      satisfaction: "> 4/5"

    practices:
      automation: "> 90%"
      testing: "> 80% coverage"
      documentation: "Comprehensive"

cloud_native_checklist:
  application:
    - [ ] "Stateless design"
    - [ ] "12-factor compliance"
    - [ ] "Health endpoints"
    - [ ] "Graceful shutdown"
    - [ ] "Structured logging"
    - [ ] "Metrics exposed"
    - [ ] "Distributed tracing"
    - [ ] "Circuit breakers"
    - [ ] "Retry logic"
    - [ ] "Configuration externalized"

  containerization:
    - [ ] "Multi-stage builds"
    - [ ] "Non-root user"
    - [ ] "Minimal base image"
    - [ ] "Security scanning"
    - [ ] "Image signing"
    - [ ] "Layer optimization"
    - [ ] "Health checks"

  kubernetes:
    - [ ] "Resource limits"
    - [ ] "Liveness probes"
    - [ ] "Readiness probes"
    - [ ] "Pod disruption budgets"
    - [ ] "Network policies"
    - [ ] "RBAC configured"
    - [ ] "Secrets management"
    - [ ] "Horizontal pod autoscaling"

  operations:
    - [ ] "GitOps workflow"
    - [ ] "Automated testing"
    - [ ] "Progressive delivery"
    - [ ] "Monitoring alerts"
    - [ ] "Runbooks"
    - [ ] "Disaster recovery"
    - [ ] "Backup strategy"