apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: kubernetes-essential
  namespace: monitoring
spec:
  groups:
  - name: kubernetes.essential
    rules:
    - alert: PodCrashLooping
      expr: kube_pod_container_status_waiting_reason{reason="CrashLoopBackOff"} == 1
      for: 10m
      labels:
        severity: warning
      annotations:
        summary: "Pod {{ $labels.namespace }}/{{ $labels.pod }} is crash looping"
    
    - alert: NodeNotReady
      expr: kube_node_status_condition{condition="Ready",status="true"} == 0
      for: 5m
      labels:
        severity: critical
      annotations:
        summary: "Node {{ $labels.node }} is not ready"
    
    - alert: HighErrorRate
      expr: |
        sum(rate(http_requests_total{status=~"5.."}[5m])) by (service) /
        sum(rate(http_requests_total[5m])) by (service) > 0.05
      for: 10m
      labels:
        severity: critical
      annotations:
        summary: "{{ $labels.service }} has {{ $value | humanizePercentage }} error rate"

- name: recording.rules
  rules:
  - record: namespace:pod_cpu:rate5m
    expr: sum(rate(container_cpu_usage_seconds_total[5m])) by (namespace, pod)

.gitlab/
├── templates/
│   ├── build.yml
│   ├── test.yml
│   ├── deploy.yml
│   └── helm.yml
└── jobs/
    ├── build-job.yml
    └── deploy-job.yml

.build_template:
  stage: build
  image: docker:24.0.7
  services:
    - docker:24.0.7-dind
  variables:
    DOCKER_HOST: tcp://docker:2376
    DOCKER_TLS_CERTDIR: "/certs"
    DOCKER_TLS_VERIFY: "1"
# на self-managed раннере в config.toml должен быть volumes = ["/certs/client", "/cache"], иначе клиент не увидит сертификаты и джоба упадёт на TLS. На shared-раннерах GitLab.com это уже настроено.
    DOCKER_CERT_PATH: "/certs/client" 
  script:
    - echo "$CI_REGISTRY_PASSWORD" | docker login -u "$CI_REGISTRY_USER" --password-stdin "$CI_REGISTRY"
    - docker build --tag "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA" .
    - docker push "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA"
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      when: manual
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
      when: always

.deploy_template:
  stage: deploy
  image: alpine/helm:3.12.0
  script:
    - helm upgrade --install "$CI_PROJECT_NAME" ./chart/ \
        --set image.repository=$CI_REGISTRY_IMAGE \
        --set image.tag=$CI_COMMIT_SHORT_SHA \
        --set environment=$DEPLOY_ENV \
        --namespace $DEPLOY_ENV \
        --create-namespace \
        --wait \
        --timeout 5m
  environment:
    name: $DEPLOY_ENV
    url: https://$CI_PROJECT_NAME.$DEPLOY_ENV.example.com
  rules:
    - if: '$DEPLOY_ENV == "prod" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
      when: manual
    - if: '$DEPLOY_ENV == "staging" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
      when: on_success

include:
  - project: 'infrastructure/ci-templates'
    ref: main
    file: '/templates/build.yml'
  - project: 'infrastructure/ci-templates'
    ref: main
    file: '/templates/deploy.yml'

variables:
  SERVICE_NAME: $CI_PROJECT_NAME

stages:
  - prepare
  - build
  - test
  - deploy

build:
  extends: .build_template

deploy_staging:
  extends: .deploy_template
  variables:
    DEPLOY_ENV: staging

deploy_prod:
  extends: .deploy_template
  variables:
    DEPLOY_ENV: prod

update_chart_version:
  stage: prepare
  image: alpine:3.18
  variables:
    GIT_DEPTH: 0          # без этого в клоне не будет тегов для git describe
  script:
    - apk add --no-cache yq git
    - |
      RAW=$(git describe --tags --always --dirty 2>/dev/null || true)
      VERSION=${RAW#v}     # убираем префикс v: v1.2.3 -> 1.2.3
      # если тега SemVer-вида нет (только хэш) — берём базовую версию
      if ! echo "$VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+'; then
        VERSION="0.0.0-${CI_COMMIT_SHORT_SHA}"
      fi
      echo "Chart version: $VERSION"
      yq -i ".version = \"${VERSION}\"" chart/Chart.yaml
    - cat chart/Chart.yaml
  artifacts:
    paths:
      - chart/Chart.yaml

update_helm_repo:
  stage: deploy
  image: alpine/git:2.40.1
  script:
    # HELM_CHARTS_TOKEN — Project/Group Access Token репозитория helm-charts
    # со scope write_repository. Задать в Settings -> CI/CD -> Variables
    # (Masked + Protected). Имя пользователя для такого токена — oauth2.
    - git clone https://oauth2:${HELM_CHARTS_TOKEN}@gitlab.com/infrastructure/helm-charts.git
    - cd helm-charts
    - mkdir -p $SERVICE_NAME
    - cp -r ../chart/* ./$SERVICE_NAME/
    - git config user.email "ci@example.com"
    - git config user.name "GitLab CI"
    - git add .
    # коммитим только при наличии изменений, чтобы не ломать пайплайн пустым коммитом
    - git diff-index --quiet HEAD || git commit -m "Update $SERVICE_NAME to $CI_COMMIT_SHORT_SHA"
    # -o ci.skip, чтобы пуш не запускал бесконечный пайплайн в репозитории чартов
    - git push -o ci.skip origin HEAD:main
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH