# .github/workflows/main-pipeline.yml
name: Build Test Deploy Pipeline

on:
  push:
    branches: [main, develop]
    paths-ignore:
      - "**/*.md"
      - "docs/**"
      - ".gitignore"
  pull_request:
    branches: [main]
  workflow_dispatch:
    inputs:
      deploy_target:
        description: "部署目标环境"
        required: true
        default: "staging"
        type: choice
        options:
          - staging
          - production

# 权限最小化原则
permissions:
  contents: read
  packages: write
  id-token: write

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  # ==================== 阶段一：代码质量与单元测试 ====================
  lint-and-test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node-version: [18, 20]
    steps:
      - name: Checkout source code
        uses: actions/checkout@v4

      - name: Setup Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache: "npm"

      - name: Install dependencies
        run: npm ci

      - name: Run ESLint
        run: npm run lint

      - name: Run unit tests
        run: npm run test:ci

      - name: Upload test coverage
        uses: codecov/codecov-action@v4
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          files: ./coverage/lcov.info
          fail_ci_if_error: false

  # ==================== 阶段二：安全扫描 ====================
  security-scan:
    runs-on: ubuntu-latest
    needs: lint-and-test
    steps:
      - uses: actions/checkout@v4

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: "fs"
          scan-ref: "."
          severity: "HIGH,CRITICAL"
          exit-code: 1

      - name: Check for leaked secrets
        uses: trufflesecurity/trufflehog@main
        with:
          path: ./
          base: main
          head: HEAD
          extra_args: --debug --only-verified

  # ==================== 阶段三：构建容器镜像 ====================
  build-image:
    runs-on: ubuntu-latest
    needs: [lint-and-test, security-scan]
    outputs:
      image_tag: ${{ steps.meta.outputs.tags }}
      image_digest: ${{ steps.build.outputs.digest }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Docker metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=schedule
            type=ref,event=branch
            type=ref,event=pr
            type=sha,prefix={{branch}}-
            type=raw,value=latest,enable={{is_default_branch}}

      - name: Build and push Docker image
        id: build
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          platforms: linux/amd64,linux/arm64

  # ==================== 阶段四：部署到 Kubernetes ====================
  deploy-staging:
    runs-on: ubuntu-latest
    needs: build-image
    if: github.ref == 'refs/heads/develop'
    environment:
      name: staging
      url: https://app-staging.example.com
    steps:
      - name: Checkout manifests repo
        uses: actions/checkout@v4
        with:
          repository: org/gitops-manifests
          token: ${{ secrets.MANIFESTS_REPO_TOKEN }}
          path: manifests

      - name: Update image tag in manifests
        working-directory: manifests
        run: |
          yq e -i '.spec.template.spec.containers[0].image = "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}"' \
            overlays/staging/deployment.yaml
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add .
          git commit -m "ci: update staging image to ${{ github.sha }}"
          git push

  deploy-production:
    runs-on: ubuntu-latest
    needs: build-image
    if: github.ref == 'refs/heads/main'
    environment:
      name: production
      url: https://app.example.com
    steps:
      - name: Checkout manifests repo
        uses: actions/checkout@v4
        with:
          repository: org/gitops-manifests
          token: ${{ secrets.MANIFESTS_REPO_TOKEN }}
          path: manifests

      - name: Update production image tag
        working-directory: manifests
        run: |
          yq e -i '.spec.template.spec.containers[0].image = "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}"' \
            overlays/production/deployment.yaml
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add .
          git commit -m "ci: update production image to ${{ github.sha }}"
          git push

# .github/workflows/reusable-docker-build.yml
name: Reusable Docker Build

on:
  workflow_call:
    inputs:
      image_name:
        required: true
        type: string
      dockerfile:
        required: false
        type: string
        default: "Dockerfile"
      platforms:
        required: false
        type: string
        default: "linux/amd64"
    secrets:
      registry_token:
        required: true
    outputs:
      image_digest:
        description: "构建出的镜像 digest"
        value: ${{ jobs.build.outputs.digest }}

jobs:
  build:
    runs-on: ubuntu-latest
    outputs:
      digest: ${{ steps.build.outputs.digest }}
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-buildx-action@v3
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.registry_token }}

      - uses: docker/build-push-action@v5
        id: build
        with:
          context: .
          file: ${{ inputs.dockerfile }}
          push: true
          tags: ghcr.io/${{ github.repository_owner }}/${{ inputs.image_name }}:latest
          platforms: ${{ inputs.platforms }}

jobs:
  call-build:
    uses: org/shared-workflows/.github/workflows/reusable-docker-build.yml@main
    with:
      image_name: "my-service"
      platforms: "linux/amd64,linux/arm64"
    secrets:
      registry_token: ${{ secrets.GITHUB_TOKEN }}

# .gitlab-ci.yml
stages:
  - build
  - test
  - security
  - package
  - deploy

variables:
  MAVEN_OPTS: "-Dmaven.repo.local=$CI_PROJECT_DIR/.m2/repository"
  DOCKER_REGISTRY: "$CI_REGISTRY"
  IMAGE_NAME: "$CI_REGISTRY_IMAGE"
  KUBECONFIG: /etc/deploy/config

# 全局缓存配置
cache:
  key: ${CI_COMMIT_REF_SLUG}
  paths:
    - .m2/repository
    - target/

# ==================== 构建阶段 ====================
build:
  stage: build
  image: maven:3.9-eclipse-temurin-21-alpine
  script:
    - mvn clean compile -DskipTests
  artifacts:
    paths:
      - target/classes/
    expire_in: 1 hour

# ==================== 测试阶段 ====================
unit_tests:
  stage: test
  image: maven:3.9-eclipse-temurin-21-alpine
  script:
    - mvn test
  artifacts:
    when: always
    reports:
      junit: target/surefire-reports/TEST-*.xml
    paths:
      - target/surefire-reports/

code_coverage:
  stage: test
  image: maven:3.9-eclipse-temurin-21-alpine
  script:
    - mvn jacoco:report
  coverage: '/Total.*?([0-9]{1,3})%/'
  artifacts:
    paths:
      - target/site/jacoco/
    expire_in: 1 week

integration_tests:
  stage: test
  image: maven:3.9-eclipse-temurin-21-alpine
  services:
    - name: postgres:15-alpine
      alias: postgres
  variables:
    POSTGRES_DB: testdb
    POSTGRES_USER: testuser
    POSTGRES_PASSWORD: testpass
    SPRING_DATASOURCE_URL: "jdbc:postgresql://postgres:5432/testdb"
  script:
    - mvn verify -P integration-tests
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"

# ==================== 安全扫描阶段 ====================
sast:
  stage: security
  image: registry.gitlab.com/security-products/sast/gl-sast:gitlab-default
  script:
    - /analyzer run
  artifacts:
    reports:
      sast: gl-sast-report.json
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

dependency_scanning:
  stage: security
  image: registry.gitlab.com/security-products/dependency-scanning/gitlab-deps-canalyzer:gitlab-default
  script:
    - /analyzer run
  artifacts:
    reports:
      dependency_scanning: dependency-scan-report.json

container_scanning:
  stage: security
  image: docker:stable
  services:
    - docker:dind
  variables:
    DOCKER_DRIVER: overlay2
  script:
    - docker build -t $IMAGE_NAME:$CI_COMMIT_SHA .
    - docker run --rm -v /var/run/docker.sock:/var/run/docker.sock
        -v $(pwd):/tmp
        aquasec/trivy image --exit-code 0 --severity HIGH,CRITICAL
        --format json -o /tmp/trivy-report.json $IMAGE_NAME:$CI_COMMIT_SHA
  artifacts:
    reports:
      container_scanning: trivy-report.json

# ==================== 打包阶段 ====================
docker_build:
  stage: package
  image: docker:stable
  services:
    - docker:dind
  before_script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
  script:
    - docker build --pull -t $IMAGE_NAME:$CI_COMMIT_SHA -t $IMAGE_NAME:latest .
    - docker push $IMAGE_NAME:$CI_COMMIT_SHA
    - docker push $IMAGE_NAME:latest
  only:
    - main
    - develop

# ==================== 部署阶段 ====================
deploy_staging:
  stage: deploy
  image: bitnami/kubectl:latest
  before_script:
    - mkdir -p /etc/deploy
    - echo "$KUBE_CONFIG_STAGING" | base64 -d > $KUBECONFIG
  script:
    - kubectl config use-context staging
    - |
      kubectl set image deployment/app app=$IMAGE_NAME:$CI_COMMIT_SHA \
        -n staging --record
    - kubectl rollout status deployment/app -n staging --timeout=300s
  environment:
    name: staging
    url: https://app-staging.example.com
  only:
    - develop

deploy_production:
  stage: deploy
  image: bitnami/kubectl:latest
  before_script:
    - mkdir -p /etc/deploy
    - echo "$KUBE_CONFIG_PROD" | base64 -d > $KUBECONFIG
  script:
    - kubectl config use-context production
    - |
      kubectl set image deployment/app app=$IMAGE_NAME:$CI_COMMIT_SHA \
        -n production --record
    - kubectl rollout status deployment/app -n production --timeout=600s
  environment:
    name: production
    url: https://app.example.com
  when: manual
  only:
    - main

# templates/java-build.yml
.build_template:
  image: maven:3.9-eclipse-temurin-21-alpine
  cache:
    key: ${CI_COMMIT_REF_SLUG}
    paths:
      - .m2/repository
  artifacts:
    paths:
      - target/
    expire_in: 1 hour

# .gitlab-ci.yml
include:
  - local: '/templates/java-build.yml'

build:
  extends: .build_template
  stage: build
  script:
    - mvn clean package -DskipTests

// Jenkinsfile (Declarative Pipeline)
pipeline {
    agent none

    environment {
        IMAGE_REGISTRY = 'registry.example.com'
        IMAGE_NAME = 'myapp'
        MAVEN_OPTS = '-Dmaven.repo.local=.m2/repository'
    }

    options {
        buildDiscarder(logRotator(numToKeepStr: '20'))
        disableConcurrentBuilds()
        timeout(time: 30, unit: 'MINUTES')
        timestamps()
    }

    stages {
        // ==================== 阶段一：并行质量门禁 ====================
        stage('Quality Gates') {
            parallel {
                stage('Unit Tests') {
                    agent {
                        kubernetes {
                            yaml """
                                apiVersion: v1
                                kind: Pod
                                spec:
                                  containers:
                                  - name: maven
                                    image: maven:3.9-eclipse-temurin-21
                                    command: ['cat']
                                    tty: true
                            """
                        }
                    }
                    steps {
                        container('maven') {
                            sh 'mvn clean test'
                        }
                    }
                    post {
                        always {
                            junit testResults: 'target/surefire-reports/*.xml'
                            publishHTML([
                                allowMissing: false,
                                alwaysLinkToLastBuild: true,
                                keepAll: true,
                                reportDir: 'target/site/jacoco',
                                reportFiles: 'index.html',
                                reportName: 'Coverage Report'
                            ])
                        }
                    }
                }

                stage('Lint') {
                    agent any
                    steps {
                        sh './mvnw compile spotbugs:check'
                    }
                }

                stage('License Check') {
                    agent any
                    steps {
                        sh './mvnw license:check'
                    }
                }
            }
        }

        // ==================== 阶段二：集成测试 ====================
        stage('Integration Tests') {
            agent {
                kubernetes {
                    yaml """
                        apiVersion: v1
                        kind: Pod
                        spec:
                          containers:
                          - name: maven
                            image: maven:3.9-eclipse-temurin-21
                            command: ['cat']
                            tty: true
                          - name: postgres
                            image: postgres:15-alpine
                            env:
                            - name: POSTGRES_DB
                              value: testdb
                            - name: POSTGRES_USER
                              value: testuser
                            - name: POSTGRES_PASSWORD
                              value: testpass
                    """
                }
            }
            steps {
                container('maven') {
                    sh 'mvn verify -P integration-tests'
                }
            }
        }

        // ==================== 阶段三：安全扫描 ====================
        stage('Security Scan') {
            agent any
            steps {
                script {
                    // 文件系统漏洞扫描
                    sh '''
                        trivy fs --scanners vuln,secret,config \
                          --severity HIGH,CRITICAL \
                          --exit-code 1 \
                          .
                    '''

                    // 构建镜像并进行容器扫描
                    sh """
                        docker build -t ${IMAGE_REGISTRY}/${IMAGE_NAME}:${env.GIT_COMMIT} .
                        trivy image --severity HIGH,CRITICAL \
                          --exit-code 1 \
                          ${IMAGE_REGISTRY}/${IMAGE_NAME}:${env.GIT_COMMIT}
                    """
                }
            }
        }

        // ==================== 阶段四：构建与推送制品 ====================
        stage('Build & Push') {
            agent any
            when {
                anyOf {
                    branch 'main'
                    branch 'develop'
                }
            }
            steps {
                script {
                    def imageTag = env.GIT_COMMIT.take(7)
                    def branchTag = env.BRANCH_NAME == 'main' ? 'latest' : 'dev'

                    docker.withRegistry("https://${IMAGE_REGISTRY}", 'registry-credentials-id') {
                        def image = docker.build("${IMAGE_REGISTRY}/${IMAGE_NAME}:${imageTag}")
                        image.push()
                        image.push(branchTag)
                    }
                }
            }
        }

        // ==================== 阶段五：部署 ====================
        stage('Deploy to Staging') {
            agent any
            when {
                branch 'develop'
            }
            steps {
                withKubeConfig([credentialsId: 'kubeconfig-staging']) {
                    sh """
                        kubectl set image deployment/app \
                          app=${IMAGE_REGISTRY}/${IMAGE_NAME}:${env.GIT_COMMIT.take(7)} \
                          -n staging --record
                        kubectl rollout status deployment/app -n staging --timeout=300s
                    """
                }
            }
        }

        stage('Deploy to Production') {
            agent any
            when {
                branch 'main'
            }
            input {
                message "确认部署到生产环境？"
                ok "确认部署"
                parameters {
                    choice(
                        name: 'DEPLOY_STRATEGY',
                        choices: ['rolling', 'blue-green', 'canary'],
                        description: '选择部署策略'
                    )
                }
            }
            steps {
                withKubeConfig([credentialsId: 'kubeconfig-production']) {
                    script {
                        if (params.DEPLOY_STRATEGY == 'rolling') {
                            sh """
                                kubectl set image deployment/app \
                                  app=${IMAGE_REGISTRY}/${IMAGE_NAME}:${env.GIT_COMMIT.take(7)} \
                                  -n production --record
                                kubectl rollout status deployment/app -n production --timeout=600s
                            """
                        } else if (params.DEPLOY_STRATEGY == 'blue-green') {
                            sh './scripts/blue-green-deploy.sh production'
                        }
                    }
                }
            }
        }
    }

    post {
        always {
            script {
                if (env.BRANCH_NAME == 'main' || env.BRANCH_NAME == 'develop') {
                    cleanWs()
                }
            }
        }
        success {
            slackSend(
                channel: '#deployments',
                color: 'good',
                message: "✅ 构建成功: ${env.JOB_NAME} #${env.BUILD_NUMBER} (<${env.BUILD_URL}|查看详情>)"
            )
        }
        failure {
            slackSend(
                channel: '#alerts',
                color: 'danger',
                message: "❌ 构建失败: ${env.JOB_NAME} #${env.BUILD_NUMBER} (<${env.BUILD_URL}|查看详情>)"
            )
        }
    }
}

// vars/buildDockerImage.groovy
def call(Map config = [:]) {
    def imageName = config.imageName ?: error("imageName is required")
    def dockerfile = config.dockerfile ?: 'Dockerfile'
    def registry = config.registry ?: 'docker.io'
    def tags = config.tags ?: ['latest']

    stage("Build Docker Image: ${imageName}") {
        script {
            def image = docker.build("${registry}/${imageName}", "-f ${dockerfile} .")
            tags.each { tag ->
                image.push(tag)
            }
        }
    }
}

@Library('my-shared-library') _

pipeline {
    agent any
    stages {
        stage('Build') {
            steps {
                buildDockerImage(
                    imageName: 'my-service',
                    registry: 'ghcr.io/myorg',
                    tags: [env.GIT_COMMIT.take(7), 'latest']
                )
            }
        }
    }
}

# argocd-application.yaml
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: order-service
  namespace: argocd
  labels:
    app.kubernetes.io/name: order-service
    environment: production
  finalizers:
    - resources-finalizer.argocd.argoproj.io
spec:
  project: production-services
  source:
    repoURL: https://github.com/company/gitops-repo.git
    targetRevision: main
    path: apps/order-service/overlays/production
    helm:
      valueFiles:
        - values-production.yaml
      parameters:
        - name: replicaCount
          value: "3"
    directory:
      recurse: true
      jsonnet: {}
  destination:
    server: https://kubernetes.default.svc
    namespace: production
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
      allowEmpty: false
    syncOptions:
      - CreateNamespace=true
      - PrunePropagationPolicy=foreground
      - PruneLast=true
    retry:
      limit: 5
      backoff:
        duration: 5s
        factor: 2
        maxDuration: 3m
  ignoreDifferences:
    - group: apps
      kind: Deployment
      jsonPointers:
        - /spec/replicas
  revisionHistoryLimit: 10

# applicationset.yaml
apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: microservices
  namespace: argocd
spec:
  generators:
    - git:
        repoURL: https://github.com/company/gitops-repo.git
        revision: main
        directories:
          - path: apps/*/overlays/production
  template:
    metadata:
      name: "{{path.basename}}-prod"
    spec:
      project: production-services
      source:
        repoURL: https://github.com/company/gitops-repo.git
        targetRevision: main
        path: "{{path}}"
      destination:
        server: https://kubernetes.default.svc
        namespace: production
      syncPolicy:
        automated:
          prune: true
          selfHeal: true
        syncOptions:
          - CreateNamespace=true

# rollout-canary.yaml
apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: order-service
  namespace: production
spec:
  replicas: 5
  strategy:
    canary:
      canaryService: order-service-canary
      stableService: order-service-stable
      trafficRouting:
        nginx:
          stableIngress: order-service-ingress
          annotationPrefix: nginx.ingress.kubernetes.io
      steps:
        - setWeight: 10
        - pause: {duration: 5m}
        - analysis:
            templates:
              - templateName: success-rate
            args:
              - name: service-name
                value: order-service-canary
        - setWeight: 50
        - pause: {duration: 10m}
        - setWeight: 100
  selector:
    matchLabels:
      app: order-service
  template:
    metadata:
      labels:
        app: order-service
    spec:
      containers:
        - name: app
          image: registry.example.com/order-service:v1.2.3
          ports:
            - containerPort: 8080

# tekton-task-build.yaml
apiVersion: tekton.dev/v1beta1
kind: Task
metadata:
  name: build-and-push
  namespace: tekton-pipelines
spec:
  params:
    - name: image-url
      type: string
      description: 目标镜像地址
    - name: dockerfile-path
      type: string
      default: ./Dockerfile
  workspaces:
    - name: source
      description: 源码工作区
    - name: dockerconfig
      description: Docker 认证信息
  steps:
    - name: clone
      image: alpine/git:v2.36.3
      workingDir: $(workspaces.source.path)
      script: |
        #!/bin/sh
        git clone https://github.com/org/repo.git .

    - name: build
      image: gcr.io/kaniko-project/executor:debug
      workingDir: $(workspaces.source.path)
      env:
        - name: DOCKER_CONFIG
          value: $(workspaces.dockerconfig.path)
      command:
        - /kaniko/executor
      args:
        - --dockerfile=$(params.dockerfile-path)
        - --destination=$(params.image-url)
        - --context=$(workspaces.source.path)
        - --cache=true

# tekton-pipeline.yaml
apiVersion: tekton.dev/v1beta1
kind: Pipeline
metadata:
  name: ci-pipeline
  namespace: tekton-pipelines
spec:
  workspaces:
    - name: shared-workspace
    - name: docker-config
  params:
    - name: git-url
      type: string
    - name: image-url
      type: string
  tasks:
    - name: fetch-source
      taskRef:
        name: git-clone
      workspaces:
        - name: output
          workspace: shared-workspace
      params:
        - name: url
          value: $(params.git-url)

    - name: run-tests
      runAfter:
        - fetch-source
      taskRef:
        name: maven-test
      workspaces:
        - name: source
          workspace: shared-workspace

    - name: build-push-image
      runAfter:
        - run-tests
      taskRef:
        name: build-and-push
      workspaces:
        - name: source
          workspace: shared-workspace
        - name: dockerconfig
          workspace: docker-config
      params:
        - name: image-url
          value: $(params.image-url)

# flux-kustomization.yaml
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: production-apps
  namespace: flux-system
spec:
  interval: 10m
  path: ./clusters/production/apps
  prune: true
  sourceRef:
    kind: GitRepository
    name: production-repo
  healthChecks:
    - apiVersion: apps/v1
      kind: Deployment
      name: order-service
      namespace: production
  timeout: 5m

# flux-image-automation.yaml
apiVersion: image.toolkit.fluxcd.io/v1beta2
kind: ImageUpdateAutomation
metadata:
  name: production-automation
  namespace: flux-system
spec:
  interval: 1m
  sourceRef:
    kind: GitRepository
    name: production-repo
  git:
    checkout:
      ref:
        branch: main
    commit:
      author:
        name: Flux Bot
        email: flux@example.com
      signingKey:
        secretRef:
          name: flux-gpg-signing-key
      messageTemplate: |
        ci(flux): automated image update

        Images:
        {{ range .Updated.Images -}}
        - {{.}}
        {{ end }}
    push:
      branch: main
  policy:
    semver:
      range: 1.x.x

# apps/order-service/base/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

resources:
  - namespace.yaml
  - deployment.yaml
  - service.yaml
  - hpa.yaml

images:
  - name: app-image
    newName: ghcr.io/org/order-service
    newTag: latest

commonLabels:
  app.kubernetes.io/name: order-service
  app.kubernetes.io/managed-by: argocd

---

# apps/order-service/overlays/staging/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

namespace: staging

resources:
  - ../../base

namePrefix: staging-

replicas:
  - name: deployment
    count: 2

patchesStrategicMerge:
  - resources-patch.yaml

configMapGenerator:
  - name: app-config
    literals:
      - LOG_LEVEL=debug
      - ENV=staging

# order-service-app.yaml (ArgoCD Application)
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: order-service-staging
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "1"
spec:
  project: staging
  source:
    repoURL: https://github.com/org/gitops-repo.git
    targetRevision: main
    path: apps/order-service/overlays/staging
  destination:
    server: https://kubernetes.default.svc
    namespace: staging
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
      - ApplyOutOfSyncOnly=true
    retry:
      limit: 3
      backoff:
        duration: 5s
        factor: 2