// Fragment de l'arrencada d'api-reserves (server.js)
const servidor = app.listen(8080);

let tancant = false;

// /preparat retorna 503 tan bon punt comença el tancament: així l'Endpoint
// es retira ABANS que deixem d'acceptar connexions.
app.get('/preparat', (req, res) => {
  if (tancant) return res.status(503).json({ estat: 'tancant' });
  return res.status(200).json({ estat: 'preparat' });
});

process.on('SIGTERM', async () => {
  tancant = true;
  // Donem marge perquè kube-proxy i l'Ingress actualitzin les seves taules.
  await new Promise((r) => setTimeout(r, 5000));
  servidor.close(async () => {
    await pool.end();          // connexions a postgres-reserves
    await redis.quit();
    process.exit(0);
  });
});

apiVersion: v1
kind: ServiceAccount
metadata:
  name: api-reserves
  namespace: rutas-norte-pro
  annotations:
    # Identitat federada a EKS (10-06): permet llegir del bucket de factures
    # sense cap clau d'accés de llarga vida.
    eks.amazonaws.com/role-arn: arn:aws:iam::111122223333:role/rutasnorte-pro-api-reserves
# El pod no necessita parlar amb l'API de Kubernetes: no li muntem el token.
automountServiceAccountToken: false
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: api-reserves-config
  namespace: rutas-norte-pro
data:
  NODE_ENV: "production"
  LOG_NIVELL: "info"
  # DNS intern: nom curt perquè som al mateix namespace.
  REDIS_URL: "redis://redis-cache:6379"
  # L'agrupador de connexions de CloudNativePG; el veurem a 11-02.
  PG_HOST: "postgres-reserves-pooler-rw"
  PG_PORT: "5432"
  PG_BASE: "reserves"
  PG_POOL_MAX: "20"
  PAGAMENTS_URL: "https://pagos.proveedorexterno.example/v2"
  PAGAMENTS_TIMEOUT_MS: "4000"
  RESERVA_TTL_SEGONS: "900"
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: api-reserves-secrets
  namespace: rutas-norte-pro
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: magatzem-rutasnorte
    kind: ClusterSecretStore
  target:
    name: api-reserves-secrets   # nom del Secret que es crearà
    creationPolicy: Owner
  data:
    - secretKey: PG_USUARI
      remoteRef: { key: pro/api-reserves/bd, property: usuari }
    - secretKey: PG_PASSWORD
      remoteRef: { key: pro/api-reserves/bd, property: password }
    - secretKey: JWT_SIGNATURA
      remoteRef: { key: pro/api-reserves/jwt, property: clau }
    - secretKey: PAGAMENTS_API_KEY
      remoteRef: { key: pro/api-reserves/pagaments, property: api_key }

apiVersion: apps/v1
kind: Deployment
metadata:
  name: api-reserves
  namespace: rutas-norte-pro
  labels:
    app.kubernetes.io/name: api-reserves
    app.kubernetes.io/part-of: rutas-norte
    app.kubernetes.io/component: backend
    rutasnorte.example/equip: desenvolupament
spec:
  # replicas NO es fixa aquí: ho governa l'HPA i Argo CD ho ignora
  # amb ignoreDifferences (10-05). Si ho fixéssim, cada sincronització
  # tornaria les rèpliques al valor del fitxer.
  revisionHistoryLimit: 5
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 0        # mai no baixem del nombre actual de rèpliques sanes
  selector:
    matchLabels:
      app.kubernetes.io/name: api-reserves
  template:
    metadata:
      labels:
        app.kubernetes.io/name: api-reserves
        app.kubernetes.io/part-of: rutas-norte
        rutasnorte.example/equip: desenvolupament
      annotations:
        # Canvia si canvia el ConfigMap: força un rollout en canviar configuració.
        rutasnorte.example/config-checksum: "sha256-8f1d2a"
    spec:
      serviceAccountName: api-reserves
      automountServiceAccountToken: false
      terminationGracePeriodSeconds: 45    # > els 5 s d'espera + peticions en curs
      securityContext:
        runAsNonRoot: true
        runAsUser: 10001
        runAsGroup: 10001
        fsGroup: 10001
        seccompProfile:
          type: RuntimeDefault
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: topology.kubernetes.io/zone
          whenUnsatisfiable: ScheduleAnyway   # preferim servei a simetria perfecta
          labelSelector:
            matchLabels:
              app.kubernetes.io/name: api-reserves
        - maxSkew: 1
          topologyKey: kubernetes.io/hostname
          whenUnsatisfiable: ScheduleAnyway
          labelSelector:
            matchLabels:
              app.kubernetes.io/name: api-reserves
      containers:
        - name: api
          # Digest, no etiqueta: l'escriu la canalització d'11-03.
          image: registry.rutasnorte.example/rutasnorte/api-reserves@sha256:3f9c1b7e5a04c2d8f61b93ae7c05d2419e8f6ab3c4d5e6f708192a3b4c5d6e7f
          imagePullPolicy: IfNotPresent
          ports:
            - name: http
              containerPort: 8080
            - name: metriques
              containerPort: 9090
          envFrom:
            - configMapRef:
                name: api-reserves-config
            - secretRef:
                name: api-reserves-secrets
          env:
            - name: POD_NOM
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
          resources:
            requests:
              cpu: 200m
              memory: 256Mi
            limits:
              memory: 512Mi        # sense límit de CPU: evita l'estrangulament (09-06)
          startupProbe:
            # Protegeix l'arrencada: fins a 60 s (12 x 5 s) abans de donar per mort el pod.
            httpGet: { path: /salut, port: http }
            periodSeconds: 5
            failureThreshold: 12
          livenessProbe:
            httpGet: { path: /salut, port: http }
            periodSeconds: 10
            timeoutSeconds: 2
            failureThreshold: 3
          readinessProbe:
            httpGet: { path: /preparat, port: http }
            periodSeconds: 5
            timeoutSeconds: 2
            failureThreshold: 2      # surt del balanceig ràpid
            successThreshold: 1
          lifecycle:
            preStop:
              exec:
                # Xarxa de seguretat addicional a la gestió de SIGTERM de l'apartat 1.4.
                command: ["/bin/sh", "-c", "sleep 5"]
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
          volumeMounts:
            - name: tmp
              mountPath: /tmp
      volumes:
        - name: tmp
          emptyDir: {}

apiVersion: v1
kind: Service
metadata:
  name: api-reserves
  namespace: rutas-norte-pro
  labels:
    app.kubernetes.io/name: api-reserves
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: api-reserves
  ports:
    - name: http
      port: 80
      targetPort: http
    - name: metriques
      port: 9090
      targetPort: metriques
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: api-reserves
  namespace: rutas-norte-pro
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-produccio
    nginx.ingress.kubernetes.io/proxy-body-size: "1m"
    nginx.ingress.kubernetes.io/limit-rps: "200"
spec:
  ingressClassName: nginx
  tls:
    - hosts: ["api.rutasnorte.example"]
      secretName: api-rutasnorte-tls     # l'omple cert-manager (04-05)
  rules:
    - host: api.rutasnorte.example
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: api-reserves
                port:
                  name: http
---
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: api-reserves
  namespace: rutas-norte-pro
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: api-reserves
  minReplicas: 4
  maxReplicas: 40          # dimensionat per al pont de maig
  metrics:
    - type: Resource
      resource:
        name: cpu
        target: { type: Utilization, averageUtilization: 65 }
  behavior:
    scaleUp:
      stabilizationWindowSeconds: 0     # pujar ràpid
      policies:
        - type: Percent
          value: 100
          periodSeconds: 30
    scaleDown:
      stabilizationWindowSeconds: 300   # baixar a poc a poc
      policies:
        - type: Percent
          value: 25
          periodSeconds: 60
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: api-reserves
  namespace: rutas-norte-pro
spec:
  minAvailable: 75%
  selector:
    matchLabels:
      app.kubernetes.io/name: api-reserves
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-reserves
  namespace: rutas-norte-pro
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: api-reserves
  policyTypes: [Ingress, Egress]
  ingress:
    - from:
        - namespaceSelector:
            matchLabels: { kubernetes.io/metadata.name: ingress-nginx }
      ports:
        - { protocol: TCP, port: 8080 }
    - from:
        - namespaceSelector:
            matchLabels: { kubernetes.io/metadata.name: monitoratge }
      ports:
        - { protocol: TCP, port: 9090 }
  egress:
    - to:
        - podSelector:
            matchLabels: { cnpg.io/cluster: postgres-reserves }
      ports: [{ protocol: TCP, port: 5432 }]
    - to:
        - podSelector:
            matchLabels: { app.kubernetes.io/name: redis-cache }
      ports: [{ protocol: TCP, port: 6379 }]
    - to:
        - namespaceSelector:
            matchLabels: { kubernetes.io/metadata.name: kube-system }
          podSelector:
            matchLabels: { k8s-app: kube-dns }
      ports: [{ protocol: UDP, port: 53 }, { protocol: TCP, port: 53 }]
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except: ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]
      ports: [{ protocol: TCP, port: 443 }]   # pagos.proveedorexterno.example
---
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: api-reserves
  namespace: rutas-norte-pro
  labels:
    release: kube-prometheus-stack     # etiqueta que el Prometheus selecciona
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: api-reserves
  endpoints:
    - port: metriques
      path: /metriques
      interval: 30s

apiVersion: v1
kind: ConfigMap
metadata:
  name: botiga-web-nginx
  namespace: rutas-norte-pro
data:
  default.conf: |
    server {
      listen 8080;
      root /usr/share/nginx/html;
      # SPA: qualsevol ruta desconeguda retorna index.html
      location / { try_files $uri $uri/ /index.html; }
      location = /salut { access_log off; return 200 "ok\n"; }
      location ~* \.(js|css|woff2|png|svg)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
      }
    }
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: botiga-web
  namespace: rutas-norte-pro
  labels:
    app.kubernetes.io/name: botiga-web
    app.kubernetes.io/part-of: rutas-norte
    rutasnorte.example/equip: desenvolupament
spec:
  revisionHistoryLimit: 5
  strategy:
    rollingUpdate: { maxSurge: 25%, maxUnavailable: 0 }
  selector:
    matchLabels: { app.kubernetes.io/name: botiga-web }
  template:
    metadata:
      labels:
        app.kubernetes.io/name: botiga-web
        app.kubernetes.io/part-of: rutas-norte
    spec:
      serviceAccountName: botiga-web
      automountServiceAccountToken: false
      terminationGracePeriodSeconds: 30
      securityContext:
        runAsNonRoot: true
        runAsUser: 10002
        seccompProfile: { type: RuntimeDefault }
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: topology.kubernetes.io/zone
          whenUnsatisfiable: ScheduleAnyway
          labelSelector:
            matchLabels: { app.kubernetes.io/name: botiga-web }
      containers:
        - name: nginx
          image: registry.rutasnorte.example/rutasnorte/botiga-web@sha256:a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90
          ports: [{ name: http, containerPort: 8080 }]
          resources:
            requests: { cpu: 50m, memory: 64Mi }
            limits: { memory: 128Mi }
          readinessProbe:
            httpGet: { path: /salut, port: http }
            periodSeconds: 5
          livenessProbe:
            httpGet: { path: /salut, port: http }
            periodSeconds: 15
          lifecycle:
            preStop: { exec: { command: ["/bin/sh", "-c", "sleep 5"] } }
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities: { drop: ["ALL"] }
          volumeMounts:
            - { name: conf, mountPath: /etc/nginx/conf.d }
            - { name: cache, mountPath: /var/cache/nginx }
            - { name: run, mountPath: /var/run }
      volumes:
        - name: conf
          configMap: { name: botiga-web-nginx }
        - { name: cache, emptyDir: {} }
        - { name: run, emptyDir: {} }
---
apiVersion: v1
kind: Service
metadata:
  name: botiga-web
  namespace: rutas-norte-pro
spec:
  selector: { app.kubernetes.io/name: botiga-web }
  ports: [{ name: http, port: 80, targetPort: http }]
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: botiga-web
  namespace: rutas-norte-pro
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-produccio
    nginx.ingress.kubernetes.io/from-to-www-redirect: "true"
spec:
  ingressClassName: nginx
  tls:
    - hosts: ["www.rutasnorte.example"]
      secretName: www-rutasnorte-tls
  rules:
    - host: www.rutasnorte.example
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service: { name: botiga-web, port: { name: http } }
---
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: botiga-web
  namespace: rutas-norte-pro
spec:
  scaleTargetRef: { apiVersion: apps/v1, kind: Deployment, name: botiga-web }
  minReplicas: 3
  maxReplicas: 15
  metrics:
    - type: Resource
      resource:
        name: cpu
        target: { type: Utilization, averageUtilization: 70 }
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: botiga-web
  namespace: rutas-norte-pro
spec:
  minAvailable: 2
  selector:
    matchLabels: { app.kubernetes.io/name: botiga-web }

metadata:
  annotations:
    argocd.argoproj.io/sync-wave: "-1"

kubectl -n rutas-norte-pro rollout status deploy/api-reserves --timeout=5m
kubectl -n rutas-norte-pro get pods -l app.kubernetes.io/name=api-reserves -o wide

NAME                            READY   STATUS    RESTARTS   AGE   NODE
api-reserves-7d4b8c9f5d-2xk9p   1/1     Running   0          62s   ip-10-0-2-41
api-reserves-7d4b8c9f5d-8mqrt   1/1     Running   0          58s   ip-10-0-3-17
api-reserves-7d4b8c9f5d-p4vzn   1/1     Running   0          55s   ip-10-0-1-93
api-reserves-7d4b8c9f5d-w6hxl   1/1     Running   0          51s   ip-10-0-2-88

kubectl -n rutas-norte-pro get pods -l app.kubernetes.io/name=api-reserves \
  -o custom-columns='POD:.metadata.name,LLEST:.status.conditions[?(@.type=="Ready")].status,REINICIS:.status.containerStatuses[0].restartCount'

kubectl -n rutas-norte-pro get endpointslice -l kubernetes.io/service-name=api-reserves -o yaml | grep -A3 addresses

    addresses:
    - 10.244.2.31
      conditions:
        ready: true

kubectl -n rutas-norte-pro run depurar --rm -it --restart=Never \
  --image=registry.rutasnorte.example/utils/netdebug:1.4 -- \
  nslookup api-reserves.rutas-norte-pro.svc.cluster.local

kubectl -n rutas-norte-pro run depurar --rm -it --restart=Never \
  --image=registry.rutasnorte.example/utils/netdebug:1.4 -- \
  curl -s -o /dev/null -w '%{http_code} %{time_total}s\n' \
  http://api-reserves/salut

200 0.004s

curl -s -o /dev/null -w 'http=%{http_code} tls=%{ssl_verify_result} t=%{time_total}s\n' \
  https://api.rutasnorte.example/salut

kubectl -n rutas-norte-pro get certificate api-rutasnorte-tls
echo | openssl s_client -connect api.rutasnorte.example:443 -servername api.rutasnorte.example 2>/dev/null \
  | openssl x509 -noout -issuer -dates

NAME                 READY   SECRET               AGE
api-rutasnorte-tls   True    api-rutasnorte-tls   184d

issuer=C=US, O=Let's Encrypt, CN=R11
notBefore=Apr 18 09:12:44 2026 GMT
notAfter=Jul 17 09:12:43 2026 GMT

kubectl -n monitoratge port-forward svc/prometheus-operated 9090:9090 &
curl -sG 'http://localhost:9090/api/v1/query' \
  --data-urlencode 'query=up{job="api-reserves"}' | jq '.data.result[] | {pod: .metric.pod, valor: .value[1]}'

{"pod":"api-reserves-7d4b8c9f5d-2xk9p","valor":"1"}
{"pod":"api-reserves-7d4b8c9f5d-8mqrt","valor":"1"}

curl -s http://alertmanager.rutas-norte.example/api/v2/alerts \
  | jq '[.[] | select(.labels.service=="api-reserves")] | length'

$ kubectl -n rutas-norte-pre get pods -l app.kubernetes.io/name=api-reserves
NAME                            READY   STATUS    RESTARTS   AGE
api-reserves-6c9f7d8b4c-hh2ks   0/1     Running   0          4m
api-reserves-6c9f7d8b4c-tq5rl   0/1     Running   0          4m

$ curl -s -o /dev/null -w '%{http_code}\n' https://api-pre.rutasnorte.example/salut
503

kubectl -n rutas-norte-pre logs -l app.kubernetes.io/name=api-reserves --tail=50
kubectl -n rutas-norte-pre describe pod -l app.kubernetes.io/name=api-reserves | grep -A10 Events
kubectl -n rutas-norte-pre get endpointslice -l kubernetes.io/service-name=api-reserves