@digilogiclabs/create-saas-app 2.0.0 → 2.2.0

package/src/templates/infrastructure/kubernetes/base/template/README.md

@@ -0,0 +1,253 @@
+# {{titleCaseName}} - Kubernetes Manifests
+
+Kubernetes manifests for deploying {{titleCaseName}} with Kustomize.
+
+## Architecture
+
+```
+┌─────────────────────────────────────────────────────────────┐
+│                    Kubernetes Cluster                        │
+├─────────────────────────────────────────────────────────────┤
+│                                                              │
+│   ┌──────────────┐    ┌──────────────┐    ┌──────────────┐  │
+│   │   Ingress    │───►│   Service    │───►│  Deployment  │  │
+│   │   (nginx)    │    │  (ClusterIP) │    │  (3 pods)    │  │
+│   └──────────────┘    └──────────────┘    └──────────────┘  │
+│          │                   │                   │           │
+│          │            ┌──────┴──────┐           │           │
+│          │            ▼             ▼           │           │
+│   ┌──────┴─────┐ ┌─────────┐ ┌─────────┐ ┌─────┴────┐     │
+│   │ TLS Secret │ │ Config  │ │ Secrets │ │   HPA    │     │
+│   │(cert-mgr)  │ │   Map   │ │         │ │(autoscale)│     │
+│   └────────────┘ └─────────┘ └─────────┘ └──────────┘     │
+│                                                              │
+│   ┌──────────────┐    ┌──────────────┐                      │
+│   │    PDB       │    │ NetworkPolicy│                      │
+│   │(disruption)  │    │  (security)  │                      │
+│   └──────────────┘    └──────────────┘                      │
+│                                                              │
+└─────────────────────────────────────────────────────────────┘
+```
+
+## Prerequisites
+
+1. **Kubernetes Cluster** (1.26+)
+2. **kubectl** configured
+3. **Kustomize** installed (or kubectl with -k flag)
+4. **cert-manager** for TLS certificates
+5. **nginx-ingress** controller
+
+## Directory Structure
+
+```
+kubernetes/
+├── base/template/          # Base manifests
+│   ├── namespace.yaml
+│   ├── serviceaccount.yaml
+│   ├── configmap.yaml
+│   ├── secret.yaml
+│   ├── deployment.yaml
+│   ├── service.yaml
+│   ├── ingress.yaml
+│   ├── hpa.yaml
+│   ├── pdb.yaml
+│   ├── networkpolicy.yaml
+│   └── kustomization.yaml
+└── production/template/    # Production overlay
+    └── kustomization.yaml
+```
+
+## Quick Start
+
+### Deploy to Staging
+
+```bash
+# Preview manifests
+kubectl kustomize base/template
+
+# Apply to cluster
+kubectl apply -k base/template
+```
+
+### Deploy to Production
+
+```bash
+# Preview manifests
+kubectl kustomize production/template
+
+# Apply to cluster
+kubectl apply -k production/template
+```
+
+## Configuration
+
+### Update Secrets
+
+Before deploying, update the secrets with actual values:
+
+```bash
+# Using kubectl
+kubectl create secret generic {{projectName}}-secrets \
+  --namespace={{projectName}} \
+  --from-literal=SUPABASE_ANON_KEY="your-key" \
+  --from-literal=SUPABASE_SERVICE_ROLE_KEY="your-key" \
+  --from-literal=STRIPE_SECRET_KEY="your-key" \
+  --dry-run=client -o yaml | kubectl apply -f -
+```
+
+For production, consider using:
+- **Sealed Secrets**: https://github.com/bitnami-labs/sealed-secrets
+- **External Secrets**: https://external-secrets.io/
+
+### Update ConfigMap
+
+```bash
+kubectl edit configmap {{projectName}}-config -n {{projectName}}
+```
+
+### Update Image
+
+```bash
+# Using kustomize
+cd production/template
+kustomize edit set image {{projectName}}=ghcr.io/your-org/{{projectName}}:v1.2.3
+kubectl apply -k .
+```
+
+## Scaling
+
+### Manual Scaling
+
+```bash
+kubectl scale deployment {{projectName}} -n {{projectName}} --replicas=5
+```
+
+### HPA Configuration
+
+The HPA automatically scales based on:
+- CPU utilization (target: 70%)
+- Memory utilization (target: 80%)
+
+```bash
+# Check HPA status
+kubectl get hpa {{projectName}} -n {{projectName}}
+
+# Watch scaling events
+kubectl describe hpa {{projectName}} -n {{projectName}}
+```
+
+## Monitoring
+
+### Check Pod Status
+
+```bash
+kubectl get pods -n {{projectName}} -l app.kubernetes.io/name={{projectName}}
+```
+
+### Check Logs
+
+```bash
+# All pods
+kubectl logs -n {{projectName}} -l app.kubernetes.io/name={{projectName}} -f
+
+# Specific pod
+kubectl logs -n {{projectName}} {{projectName}}-xxx-xxx -f
+```
+
+### Check Events
+
+```bash
+kubectl get events -n {{projectName}} --sort-by='.lastTimestamp'
+```
+
+## Health Checks
+
+The deployment includes three probes:
+
+| Probe | Path | Purpose |
+|-------|------|---------|
+| Startup | /api/health | Initial container startup |
+| Liveness | /api/health | Container health |
+| Readiness | /api/health | Traffic routing |
+
+## Security
+
+### Network Policy
+
+The NetworkPolicy restricts:
+- **Ingress**: Only from ingress-nginx and monitoring namespaces
+- **Egress**: Only DNS and HTTPS (443)
+
+### Pod Security
+
+- Runs as non-root user (UID 1000)
+- Read-only root filesystem
+- All capabilities dropped
+- No privilege escalation
+
+### Service Account
+
+- Dedicated service account
+- No auto-mounted service account token
+
+## Troubleshooting
+
+### Pod Not Starting
+
+```bash
+# Check pod events
+kubectl describe pod {{projectName}}-xxx -n {{projectName}}
+
+# Check container logs
+kubectl logs {{projectName}}-xxx -n {{projectName}} --previous
+```
+
+### Ingress Not Working
+
+```bash
+# Check ingress status
+kubectl get ingress {{projectName}} -n {{projectName}}
+
+# Check TLS certificate
+kubectl describe certificate {{projectName}}-tls -n {{projectName}}
+
+# Check ingress controller logs
+kubectl logs -n ingress-nginx -l app.kubernetes.io/name=ingress-nginx
+```
+
+### HPA Not Scaling
+
+```bash
+# Check metrics server
+kubectl get --raw /apis/metrics.k8s.io/v1beta1/pods
+
+# Check HPA status
+kubectl describe hpa {{projectName}} -n {{projectName}}
+```
+
+## Rollback
+
+```bash
+# Check rollout history
+kubectl rollout history deployment/{{projectName}} -n {{projectName}}
+
+# Rollback to previous
+kubectl rollout undo deployment/{{projectName}} -n {{projectName}}
+
+# Rollback to specific revision
+kubectl rollout undo deployment/{{projectName}} -n {{projectName}} --to-revision=2
+```
+
+## Clean Up
+
+```bash
+# Delete all resources
+kubectl delete -k base/template
+
+# Or for production
+kubectl delete -k production/template
+```
+
+## License
+
+MIT - Built with DLL Platform

package/src/templates/infrastructure/kubernetes/base/template/configmap.yaml

@@ -0,0 +1,12 @@
+# {{titleCaseName}} - Kubernetes ConfigMap
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{projectName}}-config
+  namespace: {{projectName}}
+  labels:
+    app.kubernetes.io/name: {{projectName}}
+data:
+  APP_URL: "https://{{projectName}}.example.com"
+  SUPABASE_URL: "https://xxx.supabase.co"
+  LOG_LEVEL: "info"

package/src/templates/infrastructure/kubernetes/base/template/deployment.yaml

@@ -0,0 +1,123 @@
+# {{titleCaseName}} - Kubernetes Deployment
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{projectName}}
+  namespace: {{projectName}}
+  labels:
+    app.kubernetes.io/name: {{projectName}}
+    app.kubernetes.io/component: web
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{projectName}}
+      app.kubernetes.io/component: web
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: {{projectName}}
+        app.kubernetes.io/component: web
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "3000"
+        prometheus.io/path: "/metrics"
+    spec:
+      serviceAccountName: {{projectName}}
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        fsGroup: 1000
+      containers:
+        - name: app
+          image: {{projectName}}:latest
+          imagePullPolicy: Always
+          ports:
+            - name: http
+              containerPort: 3000
+              protocol: TCP
+          env:
+            - name: NODE_ENV
+              value: "production"
+            - name: NEXT_PUBLIC_SUPABASE_URL
+              valueFrom:
+                configMapKeyRef:
+                  name: {{projectName}}-config
+                  key: SUPABASE_URL
+            - name: NEXT_PUBLIC_SUPABASE_ANON_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{projectName}}-secrets
+                  key: SUPABASE_ANON_KEY
+            - name: SUPABASE_SERVICE_ROLE_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{projectName}}-secrets
+                  key: SUPABASE_SERVICE_ROLE_KEY
+            - name: NEXT_PUBLIC_APP_URL
+              valueFrom:
+                configMapKeyRef:
+                  name: {{projectName}}-config
+                  key: APP_URL
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+          livenessProbe:
+            httpGet:
+              path: /api/health
+              port: http
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /api/health
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 3
+          startupProbe:
+            httpGet:
+              path: /api/health
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 5
+            failureThreshold: 30
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+            - name: nextjs-cache
+              mountPath: /app/.next/cache
+      volumes:
+        - name: tmp
+          emptyDir: {}
+        - name: nextjs-cache
+          emptyDir: {}
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              podAffinityTerm:
+                labelSelector:
+                  matchLabels:
+                    app.kubernetes.io/name: {{projectName}}
+                topologyKey: kubernetes.io/hostname
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: topology.kubernetes.io/zone
+          whenUnsatisfiable: ScheduleAnyway
+          labelSelector:
+            matchLabels:
+              app.kubernetes.io/name: {{projectName}}

package/src/templates/infrastructure/kubernetes/base/template/hpa.yaml

@@ -0,0 +1,45 @@
+# {{titleCaseName}} - Horizontal Pod Autoscaler
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{projectName}}
+  namespace: {{projectName}}
+  labels:
+    app.kubernetes.io/name: {{projectName}}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{projectName}}
+  minReplicas: 2
+  maxReplicas: 10
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: 70
+    - type: Resource
+      resource:
+        name: memory
+        target:
+          type: Utilization
+          averageUtilization: 80
+  behavior:
+    scaleDown:
+      stabilizationWindowSeconds: 300
+      policies:
+        - type: Percent
+          value: 50
+          periodSeconds: 60
+    scaleUp:
+      stabilizationWindowSeconds: 0
+      policies:
+        - type: Percent
+          value: 100
+          periodSeconds: 15
+        - type: Pods
+          value: 4
+          periodSeconds: 15
+      selectPolicy: Max

package/src/templates/infrastructure/kubernetes/base/template/ingress.yaml

@@ -0,0 +1,31 @@
+# {{titleCaseName}} - Kubernetes Ingress
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{projectName}}
+  namespace: {{projectName}}
+  labels:
+    app.kubernetes.io/name: {{projectName}}
+  annotations:
+    kubernetes.io/ingress.class: nginx
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/proxy-body-size: "50m"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "60"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "60"
+spec:
+  tls:
+    - hosts:
+        - "{{projectName}}.example.com"
+      secretName: {{projectName}}-tls
+  rules:
+    - host: "{{projectName}}.example.com"
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: {{projectName}}
+                port:
+                  name: http

package/src/templates/infrastructure/kubernetes/base/template/kustomization.yaml

@@ -0,0 +1,25 @@
+# {{titleCaseName}} - Kustomize Base
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+metadata:
+  name: {{projectName}}-base
+
+namespace: {{projectName}}
+
+resources:
+  - namespace.yaml
+  - serviceaccount.yaml
+  - configmap.yaml
+  - secret.yaml
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml
+  - hpa.yaml
+  - pdb.yaml
+  - networkpolicy.yaml
+
+commonLabels:
+  app.kubernetes.io/name: {{projectName}}
+  app.kubernetes.io/version: "1.0.0"
+  app.kubernetes.io/managed-by: kustomize

package/src/templates/infrastructure/kubernetes/base/template/namespace.yaml

@@ -0,0 +1,8 @@
+# {{titleCaseName}} - Kubernetes Namespace
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {{projectName}}
+  labels:
+    app.kubernetes.io/name: {{projectName}}
+    app.kubernetes.io/managed-by: kustomize

package/src/templates/infrastructure/kubernetes/base/template/networkpolicy.yaml

@@ -0,0 +1,48 @@
+# {{titleCaseName}} - Network Policy
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{projectName}}
+  namespace: {{projectName}}
+  labels:
+    app.kubernetes.io/name: {{projectName}}
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: {{projectName}}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    # Allow traffic from ingress controller
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              name: ingress-nginx
+      ports:
+        - protocol: TCP
+          port: 3000
+    # Allow traffic from monitoring
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              name: monitoring
+      ports:
+        - protocol: TCP
+          port: 3000
+  egress:
+    # Allow DNS
+    - to:
+        - namespaceSelector: {}
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+    # Allow HTTPS (Supabase, external APIs)
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+      ports:
+        - protocol: TCP
+          port: 443

package/src/templates/infrastructure/kubernetes/base/template/pdb.yaml

@@ -0,0 +1,14 @@
+# {{titleCaseName}} - Pod Disruption Budget
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{projectName}}
+  namespace: {{projectName}}
+  labels:
+    app.kubernetes.io/name: {{projectName}}
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{projectName}}
+      app.kubernetes.io/component: web

package/src/templates/infrastructure/kubernetes/base/template/secret.yaml

@@ -0,0 +1,17 @@
+# {{titleCaseName}} - Kubernetes Secret Template
+# NOTE: This is a template. In production, use sealed-secrets or external-secrets
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{projectName}}-secrets
+  namespace: {{projectName}}
+  labels:
+    app.kubernetes.io/name: {{projectName}}
+type: Opaque
+stringData:
+  # Replace with actual values or use sealed-secrets/external-secrets
+  SUPABASE_ANON_KEY: "your-supabase-anon-key"
+  SUPABASE_SERVICE_ROLE_KEY: "your-supabase-service-role-key"
+  STRIPE_SECRET_KEY: "your-stripe-secret-key"
+  STRIPE_WEBHOOK_SECRET: "your-stripe-webhook-secret"
+  OPENAI_API_KEY: "your-openai-api-key"

package/src/templates/infrastructure/kubernetes/base/template/service.yaml

@@ -0,0 +1,19 @@
+# {{titleCaseName}} - Kubernetes Service
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{projectName}}
+  namespace: {{projectName}}
+  labels:
+    app.kubernetes.io/name: {{projectName}}
+    app.kubernetes.io/component: web
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 80
+      targetPort: http
+      protocol: TCP
+  selector:
+    app.kubernetes.io/name: {{projectName}}
+    app.kubernetes.io/component: web

package/src/templates/infrastructure/kubernetes/base/template/serviceaccount.yaml

@@ -0,0 +1,9 @@
+# {{titleCaseName}} - Kubernetes Service Account
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{projectName}}
+  namespace: {{projectName}}
+  labels:
+    app.kubernetes.io/name: {{projectName}}
+automountServiceAccountToken: false