// Fragmento del arranque de api-reservas (server.js)
const servidor = app.listen(8080);

let cerrando = false;

// /preparado devuelve 503 en cuanto empieza el cierre: así el Endpoint
// se retira ANTES de que dejemos de aceptar conexiones.
app.get('/preparado', (req, res) => {
  if (cerrando) return res.status(503).json({ estado: 'cerrando' });
  return res.status(200).json({ estado: 'preparado' });
});

process.on('SIGTERM', async () => {
  cerrando = true;
  // Damos margen a que kube-proxy y el Ingress actualicen sus tablas.
  await new Promise((r) => setTimeout(r, 5000));
  servidor.close(async () => {
    await pool.end();          // conexiones a postgres-reservas
    await redis.quit();
    process.exit(0);
  });
});

apiVersion: v1
kind: ServiceAccount
metadata:
  name: api-reservas
  namespace: rutas-norte-pro
  annotations:
    # Identidad federada en EKS (10-06): permite leer del bucket de facturas
    # sin ninguna clave de acceso de larga vida.
    eks.amazonaws.com/role-arn: arn:aws:iam::111122223333:role/rutasnorte-pro-api-reservas
# El pod no necesita hablar con la API de Kubernetes: no le montamos el token.
automountServiceAccountToken: false
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: api-reservas-config
  namespace: rutas-norte-pro
data:
  NODE_ENV: "production"
  LOG_NIVEL: "info"
  # DNS interno: nombre corto porque estamos en el mismo namespace.
  REDIS_URL: "redis://redis-cache:6379"
  # El agrupador de conexiones de CloudNativePG; lo veremos en 11-02.
  PG_HOST: "postgres-reservas-pooler-rw"
  PG_PUERTO: "5432"
  PG_BASE: "reservas"
  PG_POOL_MAX: "20"
  PAGOS_URL: "https://pagos.proveedorexterno.example/v2"
  PAGOS_TIMEOUT_MS: "4000"
  RESERVA_TTL_SEGUNDOS: "900"
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: api-reservas-secretos
  namespace: rutas-norte-pro
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: almacen-rutasnorte
    kind: ClusterSecretStore
  target:
    name: api-reservas-secretos   # nombre del Secret que se creará
    creationPolicy: Owner
  data:
    - secretKey: PG_USUARIO
      remoteRef: { key: pro/api-reservas/db, property: usuario }
    - secretKey: PG_PASSWORD
      remoteRef: { key: pro/api-reservas/db, property: password }
    - secretKey: JWT_FIRMA
      remoteRef: { key: pro/api-reservas/jwt, property: clave }
    - secretKey: PAGOS_API_KEY
      remoteRef: { key: pro/api-reservas/pagos, property: api_key }

apiVersion: apps/v1
kind: Deployment
metadata:
  name: api-reservas
  namespace: rutas-norte-pro
  labels:
    app.kubernetes.io/name: api-reservas
    app.kubernetes.io/part-of: rutas-norte
    app.kubernetes.io/component: backend
    rutasnorte.example/equipo: desarrollo
spec:
  # replicas NO se fija aquí: lo gobierna el HPA y Argo CD lo ignora
  # con ignoreDifferences (10-05). Si lo fijáramos, cada sincronización
  # devolvería las réplicas al valor del fichero.
  revisionHistoryLimit: 5
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 0        # nunca bajamos del número actual de réplicas sanas
  selector:
    matchLabels:
      app.kubernetes.io/name: api-reservas
  template:
    metadata:
      labels:
        app.kubernetes.io/name: api-reservas
        app.kubernetes.io/part-of: rutas-norte
        rutasnorte.example/equipo: desarrollo
      annotations:
        # Cambia si cambia el ConfigMap: fuerza un rollout al cambiar configuración.
        rutasnorte.example/config-checksum: "sha256-8f1d2a"
    spec:
      serviceAccountName: api-reservas
      automountServiceAccountToken: false
      terminationGracePeriodSeconds: 45    # > los 5 s de espera + peticiones en curso
      securityContext:
        runAsNonRoot: true
        runAsUser: 10001
        runAsGroup: 10001
        fsGroup: 10001
        seccompProfile:
          type: RuntimeDefault
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: topology.kubernetes.io/zone
          whenUnsatisfiable: ScheduleAnyway   # preferimos servicio a simetría perfecta
          labelSelector:
            matchLabels:
              app.kubernetes.io/name: api-reservas
        - maxSkew: 1
          topologyKey: kubernetes.io/hostname
          whenUnsatisfiable: ScheduleAnyway
          labelSelector:
            matchLabels:
              app.kubernetes.io/name: api-reservas
      containers:
        - name: api
          # Digest, no etiqueta: lo escribe la canalización de 11-03.
          image: registry.rutasnorte.example/rutasnorte/api-reservas@sha256:3f9c1b7e5a04c2d8f61b93ae7c05d2419e8f6ab3c4d5e6f708192a3b4c5d6e7f
          imagePullPolicy: IfNotPresent
          ports:
            - name: http
              containerPort: 8080
            - name: metricas
              containerPort: 9090
          envFrom:
            - configMapRef:
                name: api-reservas-config
            - secretRef:
                name: api-reservas-secretos
          env:
            - name: POD_NOMBRE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
          resources:
            requests:
              cpu: 200m
              memory: 256Mi
            limits:
              memory: 512Mi        # sin límite de CPU: evita el estrangulamiento (09-06)
          startupProbe:
            # Protege el arranque: hasta 60 s (12 x 5 s) antes de dar por muerto el pod.
            httpGet: { path: /salud, port: http }
            periodSeconds: 5
            failureThreshold: 12
          livenessProbe:
            httpGet: { path: /salud, port: http }
            periodSeconds: 10
            timeoutSeconds: 2
            failureThreshold: 3
          readinessProbe:
            httpGet: { path: /preparado, port: http }
            periodSeconds: 5
            timeoutSeconds: 2
            failureThreshold: 2      # sale del balanceo rápido
            successThreshold: 1
          lifecycle:
            preStop:
              exec:
                # Red de seguridad adicional al manejo de SIGTERM del apartado 1.4.
                command: ["/bin/sh", "-c", "sleep 5"]
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
          volumeMounts:
            - name: tmp
              mountPath: /tmp
      volumes:
        - name: tmp
          emptyDir: {}

apiVersion: v1
kind: Service
metadata:
  name: api-reservas
  namespace: rutas-norte-pro
  labels:
    app.kubernetes.io/name: api-reservas
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: api-reservas
  ports:
    - name: http
      port: 80
      targetPort: http
    - name: metricas
      port: 9090
      targetPort: metricas
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: api-reservas
  namespace: rutas-norte-pro
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-produccion
    nginx.ingress.kubernetes.io/proxy-body-size: "1m"
    nginx.ingress.kubernetes.io/limit-rps: "200"
spec:
  ingressClassName: nginx
  tls:
    - hosts: ["api.rutasnorte.example"]
      secretName: api-rutasnorte-tls     # lo rellena cert-manager (04-05)
  rules:
    - host: api.rutasnorte.example
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: api-reservas
                port:
                  name: http
---
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: api-reservas
  namespace: rutas-norte-pro
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: api-reservas
  minReplicas: 4
  maxReplicas: 40          # dimensionado para el puente de mayo
  metrics:
    - type: Resource
      resource:
        name: cpu
        target: { type: Utilization, averageUtilization: 65 }
  behavior:
    scaleUp:
      stabilizationWindowSeconds: 0     # subir rápido
      policies:
        - type: Percent
          value: 100
          periodSeconds: 30
    scaleDown:
      stabilizationWindowSeconds: 300   # bajar despacio
      policies:
        - type: Percent
          value: 25
          periodSeconds: 60
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: api-reservas
  namespace: rutas-norte-pro
spec:
  minAvailable: 75%
  selector:
    matchLabels:
      app.kubernetes.io/name: api-reservas
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-reservas
  namespace: rutas-norte-pro
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: api-reservas
  policyTypes: [Ingress, Egress]
  ingress:
    - from:
        - namespaceSelector:
            matchLabels: { kubernetes.io/metadata.name: ingress-nginx }
      ports:
        - { protocol: TCP, port: 8080 }
    - from:
        - namespaceSelector:
            matchLabels: { kubernetes.io/metadata.name: monitorizacion }
      ports:
        - { protocol: TCP, port: 9090 }
  egress:
    - to:
        - podSelector:
            matchLabels: { cnpg.io/cluster: postgres-reservas }
      ports: [{ protocol: TCP, port: 5432 }]
    - to:
        - podSelector:
            matchLabels: { app.kubernetes.io/name: redis-cache }
      ports: [{ protocol: TCP, port: 6379 }]
    - to:
        - namespaceSelector:
            matchLabels: { kubernetes.io/metadata.name: kube-system }
          podSelector:
            matchLabels: { k8s-app: kube-dns }
      ports: [{ protocol: UDP, port: 53 }, { protocol: TCP, port: 53 }]
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except: ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]
      ports: [{ protocol: TCP, port: 443 }]   # pagos.proveedorexterno.example
---
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: api-reservas
  namespace: rutas-norte-pro
  labels:
    release: kube-prometheus-stack     # etiqueta que el Prometheus selecciona
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: api-reservas
  endpoints:
    - port: metricas
      path: /metricas
      interval: 30s

apiVersion: v1
kind: ConfigMap
metadata:
  name: tienda-web-nginx
  namespace: rutas-norte-pro
data:
  default.conf: |
    server {
      listen 8080;
      root /usr/share/nginx/html;
      # SPA: cualquier ruta desconocida devuelve index.html
      location / { try_files $uri $uri/ /index.html; }
      location = /salud { access_log off; return 200 "ok\n"; }
      location ~* \.(js|css|woff2|png|svg)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
      }
    }
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: tienda-web
  namespace: rutas-norte-pro
  labels:
    app.kubernetes.io/name: tienda-web
    app.kubernetes.io/part-of: rutas-norte
    rutasnorte.example/equipo: desarrollo
spec:
  revisionHistoryLimit: 5
  strategy:
    rollingUpdate: { maxSurge: 25%, maxUnavailable: 0 }
  selector:
    matchLabels: { app.kubernetes.io/name: tienda-web }
  template:
    metadata:
      labels:
        app.kubernetes.io/name: tienda-web
        app.kubernetes.io/part-of: rutas-norte
    spec:
      serviceAccountName: tienda-web
      automountServiceAccountToken: false
      terminationGracePeriodSeconds: 30
      securityContext:
        runAsNonRoot: true
        runAsUser: 10002
        seccompProfile: { type: RuntimeDefault }
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: topology.kubernetes.io/zone
          whenUnsatisfiable: ScheduleAnyway
          labelSelector:
            matchLabels: { app.kubernetes.io/name: tienda-web }
      containers:
        - name: nginx
          image: registry.rutasnorte.example/rutasnorte/tienda-web@sha256:a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90
          ports: [{ name: http, containerPort: 8080 }]
          resources:
            requests: { cpu: 50m, memory: 64Mi }
            limits: { memory: 128Mi }
          readinessProbe:
            httpGet: { path: /salud, port: http }
            periodSeconds: 5
          livenessProbe:
            httpGet: { path: /salud, port: http }
            periodSeconds: 15
          lifecycle:
            preStop: { exec: { command: ["/bin/sh", "-c", "sleep 5"] } }
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities: { drop: ["ALL"] }
          volumeMounts:
            - { name: conf, mountPath: /etc/nginx/conf.d }
            - { name: cache, mountPath: /var/cache/nginx }
            - { name: run, mountPath: /var/run }
      volumes:
        - name: conf
          configMap: { name: tienda-web-nginx }
        - { name: cache, emptyDir: {} }
        - { name: run, emptyDir: {} }
---
apiVersion: v1
kind: Service
metadata:
  name: tienda-web
  namespace: rutas-norte-pro
spec:
  selector: { app.kubernetes.io/name: tienda-web }
  ports: [{ name: http, port: 80, targetPort: http }]
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: tienda-web
  namespace: rutas-norte-pro
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-produccion
    nginx.ingress.kubernetes.io/from-to-www-redirect: "true"
spec:
  ingressClassName: nginx
  tls:
    - hosts: ["www.rutasnorte.example"]
      secretName: www-rutasnorte-tls
  rules:
    - host: www.rutasnorte.example
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service: { name: tienda-web, port: { name: http } }
---
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: tienda-web
  namespace: rutas-norte-pro
spec:
  scaleTargetRef: { apiVersion: apps/v1, kind: Deployment, name: tienda-web }
  minReplicas: 3
  maxReplicas: 15
  metrics:
    - type: Resource
      resource:
        name: cpu
        target: { type: Utilization, averageUtilization: 70 }
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: tienda-web
  namespace: rutas-norte-pro
spec:
  minAvailable: 2
  selector:
    matchLabels: { app.kubernetes.io/name: tienda-web }

metadata:
  annotations:
    argocd.argoproj.io/sync-wave: "-1"

kubectl -n rutas-norte-pro rollout status deploy/api-reservas --timeout=5m
kubectl -n rutas-norte-pro get pods -l app.kubernetes.io/name=api-reservas -o wide

NAME                            READY   STATUS    RESTARTS   AGE   NODE
api-reservas-7d4b8c9f5d-2xk9p   1/1     Running   0          62s   ip-10-0-2-41
api-reservas-7d4b8c9f5d-8mqrt   1/1     Running   0          58s   ip-10-0-3-17
api-reservas-7d4b8c9f5d-p4vzn   1/1     Running   0          55s   ip-10-0-1-93
api-reservas-7d4b8c9f5d-w6hxl   1/1     Running   0          51s   ip-10-0-2-88

kubectl -n rutas-norte-pro get pods -l app.kubernetes.io/name=api-reservas \
  -o custom-columns='POD:.metadata.name,LISTO:.status.conditions[?(@.type=="Ready")].status,REINICIOS:.status.containerStatuses[0].restartCount'

kubectl -n rutas-norte-pro get endpointslice -l kubernetes.io/service-name=api-reservas -o yaml | grep -A3 addresses

    addresses:
    - 10.244.2.31
      conditions:
        ready: true

kubectl -n rutas-norte-pro run depurar --rm -it --restart=Never \
  --image=registry.rutasnorte.example/utiles/netdebug:1.4 -- \
  nslookup api-reservas.rutas-norte-pro.svc.cluster.local

kubectl -n rutas-norte-pro run depurar --rm -it --restart=Never \
  --image=registry.rutasnorte.example/utiles/netdebug:1.4 -- \
  curl -s -o /dev/null -w '%{http_code} %{time_total}s\n' \
  http://api-reservas/salud

200 0.004s

curl -s -o /dev/null -w 'http=%{http_code} tls=%{ssl_verify_result} t=%{time_total}s\n' \
  https://api.rutasnorte.example/salud

kubectl -n rutas-norte-pro get certificate api-rutasnorte-tls
echo | openssl s_client -connect api.rutasnorte.example:443 -servername api.rutasnorte.example 2>/dev/null \
  | openssl x509 -noout -issuer -dates

NAME                 READY   SECRET               AGE
api-rutasnorte-tls   True    api-rutasnorte-tls   184d

issuer=C=US, O=Let's Encrypt, CN=R11
notBefore=Apr 18 09:12:44 2026 GMT
notAfter=Jul 17 09:12:43 2026 GMT

kubectl -n monitorizacion port-forward svc/prometheus-operated 9090:9090 &
curl -sG 'http://localhost:9090/api/v1/query' \
  --data-urlencode 'query=up{job="api-reservas"}' | jq '.data.result[] | {pod: .metric.pod, valor: .value[1]}'

{"pod":"api-reservas-7d4b8c9f5d-2xk9p","valor":"1"}
{"pod":"api-reservas-7d4b8c9f5d-8mqrt","valor":"1"}

curl -s http://alertmanager.rutas-norte.example/api/v2/alerts \
  | jq '[.[] | select(.labels.service=="api-reservas")] | length'

$ kubectl -n rutas-norte-pre get pods -l app.kubernetes.io/name=api-reservas
NAME                            READY   STATUS    RESTARTS   AGE
api-reservas-6c9f7d8b4c-hh2ks   0/1     Running   0          4m
api-reservas-6c9f7d8b4c-tq5rl   0/1     Running   0          4m

$ curl -s -o /dev/null -w '%{http_code}\n' https://api-pre.rutasnorte.example/salud
503

kubectl -n rutas-norte-pre logs -l app.kubernetes.io/name=api-reservas --tail=50
kubectl -n rutas-norte-pre describe pod -l app.kubernetes.io/name=api-reservas | grep -A10 Events
kubectl -n rutas-norte-pre get endpointslice -l kubernetes.io/service-name=api-reservas