@jetrabbits/agentic 0.0.1

package/areas/devops/kubernetes/workflows/onboard-service.md

@@ -0,0 +1,124 @@
+---
+name: onboard-service
+type: workflow
+trigger: /onboard-service
+description: Onboard a new application to Kubernetes — namespace, RBAC, NetworkPolicy, Helm chart, ArgoCD app, HPA, and monitoring.
+inputs:
+  - service_name
+  - team_name
+  - environment
+  - resource_profile (small|medium|large)
+outputs:
+  - running_service
+  - argocd_app
+  - monitoring_dashboard
+roles:
+  - devops-engineer
+  - developer
+  - team-lead
+execution:
+  initiator: developer
+related-rules:
+  - cluster-standards.md
+  - workload-security.md
+  - resource-governance.md
+uses-skills:
+  - helm-charts
+  - rbac-design
+  - network-policies
+  - resource-tuning
+quality-gates:
+  - all manifests pass `kubectl apply --dry-run=server`
+  - helm lint passes with no warnings
+  - service reachable via health endpoint after deploy
+---
+
+## Steps
+
+### 1. Namespace Setup — `@devops-engineer`
+- **Input:** service_name, team_name, environment
+- **Actions:**
+  ```bash
+  # Create namespace with required labels
+  kubectl create namespace ${SERVICE}-${ENV}
+  kubectl label namespace ${SERVICE}-${ENV} \
+    team=${TEAM} \
+    environment=${ENV} \
+    kubernetes.io/metadata.name=${SERVICE}-${ENV} \
+    pod-security.kubernetes.io/enforce=restricted
+  
+  # Apply default LimitRange and ResourceQuota from team profile
+  kubectl apply -f infra/namespaces/templates/${RESOURCE_PROFILE}/ \
+    -n ${SERVICE}-${ENV}
+  ```
+- **Output:** namespace created with labels, LimitRange, ResourceQuota
+- **Done when:** `kubectl get ns ${SERVICE}-${ENV}` shows Active
+
+### 2. RBAC Setup — `@devops-engineer`
+- **Input:** service_name, team_name
+- **Actions:**
+  - Create dedicated ServiceAccount for the workload
+  - Create Role with minimum permissions (ConfigMap read, own Secret read)
+  - Create RoleBinding
+  - Create developer RoleBinding (group → `edit` ClusterRole in namespace)
+  - Create CI/CD RoleBinding (ci-deployer ClusterRole → namespace)
+- **Output:** ServiceAccount + Role + RoleBindings committed to `infra/rbac/` and applied
+- **Done when:** `kubectl auth can-i list pods --as=system:serviceaccount:${NS}:${SA}` returns yes
+
+### 3. Network Policies — `@devops-engineer`
+- **Input:** service dependencies (which services it calls / which call it)
+- **Actions:**
+  - Apply default-deny-all + allow-dns templates
+  - For each upstream dependency: add egress policy to target namespace:port
+  - For each downstream caller: add ingress policy from source namespace
+  - Add Prometheus scrape allow policy
+- **Output:** NetworkPolicy manifests in `infra/netpol/${SERVICE}/` applied
+- **Done when:** `kubectl get networkpolicy -n ${NS}` shows all 3+ policies
+
+### 4. Helm Chart — `@developer` + `@devops-engineer`
+- **Input:** service container image, port, health endpoints, env vars
+- **Actions:**
+  - Scaffold chart: `helm create charts/${SERVICE}`
+  - Update `values.yaml` with resource profile defaults
+  - Add security context (runAsNonRoot, readOnlyRootFilesystem, drop ALL caps)
+  - Add HPA, PDB manifests
+  - Add Ingress if service is externally exposed
+  - Run: `helm lint charts/${SERVICE}/ -f values-${ENV}.yaml`
+  - Run: `helm template ... | kubectl apply --dry-run=server -f -`
+- **Output:** chart in `charts/${SERVICE}/` with passing lint and dry-run
+- **Done when:** zero lint warnings; dry-run applies cleanly
+
+### 5. ArgoCD Application — `@devops-engineer`
+- **Input:** chart path, namespace, environment
+- **Actions:**
+  - Create `argocd/apps/${SERVICE}-${ENV}.yaml` Application manifest
+  - Set `automated.prune=true`, `automated.selfHeal=true`
+  - Set `syncPolicy.syncOptions: ServerSideApply=true`
+  - Commit and push; ArgoCD auto-syncs
+- **Output:** ArgoCD Application showing Synced + Healthy
+- **Done when:** ArgoCD UI shows green; pod Running in cluster
+
+### 6. Validate & Smoke Test — `@developer`
+- **Input:** running service
+- **Actions:**
+  ```bash
+  kubectl rollout status deployment/${SERVICE} -n ${NS}
+  kubectl get pods -n ${NS} -l app=${SERVICE}
+  # Health check
+  kubectl port-forward svc/${SERVICE} 8080:8080 -n ${NS} &
+  curl -f http://localhost:8080/health
+  ```
+- **Output:** service health endpoint returns 200
+- **Done when:** health check passes; no pod restarts in 5 minutes
+
+### 7. Monitoring — `@devops-engineer`
+- **Input:** running service
+- **Actions:**
+  - Add `ServiceMonitor` for Prometheus scraping
+  - Import standard dashboard from `infra/dashboards/service-overview.json` into Grafana
+  - Set up basic alerts: HighErrorRate, HighLatency, PodRestarting
+- **Output:** metrics visible in Grafana; alerts configured
+- **Done when:** Grafana dashboard shows service metrics
+
+## Exit
+Pod Running + health check passing + ArgoCD Healthy + metrics visible = service onboarded.

package/areas/devops/kubernetes/workflows/upgrade-cluster.md

@@ -0,0 +1,165 @@
+---
+name: upgrade-cluster
+type: workflow
+trigger: /upgrade-cluster
+description: Zero-downtime Kubernetes cluster upgrade — control plane first, then workers, with rollback plan.
+inputs:
+  - current_version
+  - target_version
+  - cluster_name
+outputs:
+  - upgraded_cluster
+  - upgrade_report
+roles:
+  - devops-engineer
+  - team-lead
+execution:
+  initiator: developer
+related-rules:
+  - upgrade-policy.md
+  - cluster-standards.md
+uses-skills:
+  - cluster-operations
+quality-gates:
+  - etcd backup verified before upgrade starts
+  - no active P0/P1 incidents
+  - deprecated API audit shows zero blocking deprecations
+  - staging upgraded and healthy for ≥ 48h before production
+---
+
+## Pre-Upgrade Checklist — `@devops-engineer` (1–2 days before)
+
+```bash
+# 1. Audit deprecated APIs (kubent = kube-no-trouble)
+kubent --target-version <target>
+
+# 2. Check component compatibility matrix
+# Verify: ArgoCD, Cert-Manager, Ingress Controller, Prometheus Operator
+# support target K8s version — check each project's release notes
+
+# 3. Verify all nodes are Ready and no pending workloads
+kubectl get nodes
+kubectl get pods -A | grep -v Running | grep -v Completed
+
+# 4. Check PodDisruptionBudgets won't block drain
+kubectl get pdb -A
+
+# 5. Review CHANGELOG for breaking changes between versions
+# https://kubernetes.io/releases/
+```
+
+## Steps
+
+### 1. etcd Backup — `@devops-engineer`
+- **Input:** cluster_name, target_version
+- **Actions:**
+  ```bash
+  ETCDCTL_API=3 etcdctl snapshot save \
+    /backup/etcd-pre-upgrade-$(date +%Y%m%d-%H%M%S).db \
+    --endpoints=https://127.0.0.1:2379 \
+    --cacert=/etc/kubernetes/pki/etcd/ca.crt \
+    --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt \
+    --key=/etc/kubernetes/pki/etcd/healthcheck-client.key
+  
+  # Verify backup integrity
+  ETCDCTL_API=3 etcdctl snapshot status /backup/etcd-pre-upgrade-*.db \
+    --write-out=table
+  ```
+- **Done when:** backup file exists, status shows correct revision and hash
+
+### 2. Upgrade Control Plane (kubeadm) — `@devops-engineer`
+- **Input:** target_version
+- **Actions (on first control plane node):**
+  ```bash
+  # Update kubeadm
+  apt-get update && apt-get install -y kubeadm=<target>
+
+  # Dry-run first
+  kubeadm upgrade plan
+  kubeadm upgrade apply v<target> --dry-run
+
+  # Apply upgrade
+  kubeadm upgrade apply v<target>
+
+  # Upgrade kubelet and kubectl on control plane node
+  apt-get install -y kubelet=<target> kubectl=<target>
+  systemctl daemon-reload && systemctl restart kubelet
+  ```
+- **Actions (remaining control plane nodes):**
+  ```bash
+  kubeadm upgrade node   # (not apply — only 'node' for additional CP nodes)
+  apt-get install -y kubelet=<target> kubectl=<target>
+  systemctl daemon-reload && systemctl restart kubelet
+  ```
+- **Done when:** `kubectl version` shows new server version; all CP pods Running
+
+### 3. Validate Control Plane — `@devops-engineer`
+- **Input:** upgraded control plane
+- **Actions:**
+  ```bash
+  kubectl get nodes          # CP nodes show new version
+  kubectl get pods -n kube-system
+  kubectl get cs             # componentstatuses
+  # Run a quick API smoke test
+  kubectl run test --image=nginx --restart=Never -n default
+  kubectl delete pod test -n default
+  ```
+- **Done when:** all system pods Running; API server responsive
+
+### 4. Upgrade Worker Nodes (rolling) — `@devops-engineer`
+- **Input:** validated control plane
+- **Actions (for each worker node, one at a time):**
+  ```bash
+  # Cordon + drain
+  kubectl cordon <node>
+  kubectl drain <node> \
+    --ignore-daemonsets \
+    --delete-emptydir-data \
+    --grace-period=60 \
+    --timeout=300s
+  
+  # Upgrade node (run on the node itself)
+  apt-get update && apt-get install -y kubeadm=<target>
+  kubeadm upgrade node
+  apt-get install -y kubelet=<target> kubectl=<target>
+  systemctl daemon-reload && systemctl restart kubelet
+  
+  # Return to service
+  kubectl uncordon <node>
+  
+  # Wait for node Ready + all pods rescheduled before next node
+  kubectl wait --for=condition=Ready node/<node> --timeout=5m
+  sleep 60   # let pods stabilise
+  ```
+- **Done when:** all nodes show new version in `kubectl get nodes`
+
+### 5. Post-Upgrade Validation — `@devops-engineer` + `@team-lead`
+- **Actions:**
+  ```bash
+  kubectl get nodes -o wide
+  kubectl get pods -A | grep -v Running | grep -v Completed
+  kubectl top nodes
+  ```
+  - Run smoke tests against all Tier 1 services
+  - Verify ArgoCD, Cert-Manager, Prometheus Operator pods healthy
+  - Check monitoring dashboards for anomalies
+- **Output:** `upgrade_report.md` — versions before/after, issues found, time taken
+- **Done when:** all Tier 1 services healthy; no unexpected pod restarts
+
+## Rollback Plan
+
+```bash
+# Control plane rollback (if upgrade apply fails — only within same session)
+kubeadm upgrade apply v<previous-version>
+
+# Full disaster recovery (if cluster is broken)
+# 1. Stop kube-apiserver
+# 2. Restore etcd from backup:
+ETCDCTL_API=3 etcdctl snapshot restore /backup/etcd-pre-upgrade.db \
+  --data-dir=/var/lib/etcd-restored
+# 3. Update etcd static pod manifest to new data-dir
+# 4. Restart control plane
+```
+
+## Exit
+All nodes on target version + Tier 1 services healthy + upgrade report committed = upgrade complete.

package/areas/devops/networking/AGENTS.md

@@ -0,0 +1,47 @@
+# Networking — guidance index
+
+## What this area covers
+
+Platform networking: Kubernetes ingress design, TLS termination, service mesh onboarding, DNS management, VPC design, and network segmentation. Networking changes are high-blast-radius — this area enforces a plan-review-apply discipline.
+
+## Guidance chain
+
+1. Project `.agent/` baseline
+2. `networking/rules/*` — load all
+3. `networking/skills/*/SKILL.md` — load only the skill matching the current task
+4. `networking/workflows/*` — load the workflow matching the triggered command
+
+## Cross-cutting constraints
+
+- **TLS everywhere** — plaintext traffic is forbidden between services and at ingress, without exception.
+- **Network segmentation by default** — all services start with deny-all; allow only documented traffic.
+- **DNS changes have TTL awareness** — all DNS modifications account for TTL propagation before declaring success.
+- **No routing changes without rollback** — every networking change includes a verified rollback procedure.
+
+## Spec map
+
+```text
+networking/
+├── rules/
+│   ├── tls-policy.md               ← minimum TLS version, cert rotation, mTLS requirements
+│   ├── ingress-standards.md        ← ingress class, annotations, rate limiting, WAF baseline
+│   └── network-segmentation.md     ← namespace isolation, egress controls, VPC peering rules
+├── skills/
+│   ├── ingress-patterns/SKILL.md    ← NGINX / Traefik / Gateway API patterns
+│   ├── tls-termination/SKILL.md     ← cert-manager, Let's Encrypt, mTLS between services
+│   ├── service-mesh/SKILL.md        ← Istio / Linkerd traffic management, observability
+│   ├── dns-management/SKILL.md      ← external-dns, split-horizon, TTL strategy
+│   └── vpc-design/SKILL.md          ← subnet strategy, NAT, VPC peering, PrivateLink
+├── workflows/
+│   ├── onboard-ingress.md         ← /onboard-ingress
+│   └── service-mesh-onboard.md    ← /service-mesh-onboard
+└── prompts/
+    └── *.md
+```
+
+## Discovery patterns
+
+- `rules/*.md`
+- `skills/*/SKILL.md`
+- `workflows/*.md`
+- `prompts/*.md`

package/areas/devops/networking/prompts/onboard-ingress.md

@@ -0,0 +1,119 @@
+---
+workflow: onboard-ingress
+---
+
+# Prompt: `/onboard-ingress`
+
+Use when: exposing a service through Kubernetes ingress, including TLS issuance, DNS wiring, and production traffic controls.
+
+---
+
+## Example 1 — Public API with TLS (Let's Encrypt)
+
+**EN:**
+```
+/onboard-ingress
+
+Service: api-gateway / Namespace: production
+Expose at: api.example.com
+Backend: api-gateway service, port 8080
+TLS: Let's Encrypt via cert-manager (cluster-issuer: letsencrypt-prod)
+Requirements:
+  - HTTP → HTTPS redirect
+  - HSTS header (max-age 1 year)
+  - Rate limit: 200 RPS, max 50 connections per IP
+  - Security headers: X-Frame-Options DENY, X-Content-Type-Options nosniff
+  - CORS: allow origin https://app.example.com only
+  - Timeouts: connect 10s, read 60s
+Bare-metal: MetalLB in L2 mode, IP pool already configured
+```
+
+**RU:**
+```
+/onboard-ingress
+
+Сервис: api-gateway / Namespace: production
+Публикуем по адресу: api.example.com
+Backend: сервис api-gateway, порт 8080
+TLS: Let's Encrypt через cert-manager (cluster-issuer: letsencrypt-prod)
+Требования:
+  - Редирект HTTP → HTTPS
+  - HSTS заголовок (max-age 1 год)
+  - Rate limit: 200 RPS, макс 50 соединений с одного IP
+  - Security headers: X-Frame-Options DENY, X-Content-Type-Options nosniff
+  - CORS: разрешить только origin https://app.example.com
+  - Таймауты: connect 10s, read 60s
+Bare-metal: MetalLB в режиме L2, IP pool уже настроен
+```
+
+---
+
+## Example 2 — Internal service with canary routing
+
+**EN:**
+```
+/onboard-ingress
+
+Service: payment-service / Namespace: production
+Expose at: payments.internal.example.com (internal DNS only, not public)
+TLS: internal CA via cert-manager (cluster-issuer: vault-pki)
+Canary: 10% traffic to payment-service-v2 (new version being tested)
+Canary header: X-Canary: true → 100% to v2 (for QA testing)
+No CORS needed (internal service-to-service only)
+```
+
+**RU:**
+```
+/onboard-ingress
+
+Сервис: payment-service / Namespace: production
+Публикуем по адресу: payments.internal.example.com (только внутренний DNS, не публичный)
+TLS: внутренний CA через cert-manager (cluster-issuer: vault-pki)
+Canary: 10% трафика на payment-service-v2 (новая версия тестируется)
+Canary header: X-Canary: true → 100% на v2 (для тестирования QA)
+CORS не нужен (только внутренний service-to-service)
+```
+
+---
+
+## Example 3 — cert-manager certificate stuck in Pending
+
+**EN:**
+```
+/onboard-ingress
+
+Tool: cert-manager / Issuer: letsencrypt-prod (ClusterIssuer)
+Certificate: api-example-com-tls in namespace production
+Status: kubectl get certificate → "False / Issuing" for > 10 min
+Ingress host: api.example.com
+Debug workflow:
+  1. kubectl describe certificate api-example-com-tls -n production
+  2. kubectl describe certificaterequest -n production (find matching CR)
+  3. kubectl describe order -n production (ACME order status)
+  4. kubectl describe challenge -n production (HTTP-01 or DNS-01 challenge status)
+  5. Common failure modes:
+     - HTTP-01: Ingress not serving /.well-known/acme-challenge/ (check ingress annotations)
+     - HTTP-01: firewall blocking port 80 from Let's Encrypt IPs
+     - DNS-01: wrong Route53 permissions or wrong hosted zone
+     - Rate limit: too many failed attempts (check cert-manager logs)
+```
+
+**RU:**
+```
+/onboard-ingress
+
+Инструмент: cert-manager / Issuer: letsencrypt-prod (ClusterIssuer)
+Сертификат: api-example-com-tls в namespace production
+Статус: kubectl get certificate → "False / Issuing" уже > 10 мин
+Хост Ingress: api.example.com
+Процесс отладки:
+  1. kubectl describe certificate api-example-com-tls -n production
+  2. kubectl describe certificaterequest -n production (найти соответствующий CR)
+  3. kubectl describe order -n production (статус ACME order)
+  4. kubectl describe challenge -n production (статус HTTP-01 или DNS-01 challenge)
+  5. Типичные причины отказа:
+     - HTTP-01: Ingress не обслуживает /.well-known/acme-challenge/ (проверить аннотации ingress)
+     - HTTP-01: firewall блокирует порт 80 от IP Let's Encrypt
+     - DNS-01: неверные права Route53 или неверный hosted zone
+     - Rate limit: слишком много неудачных попыток (проверить логи cert-manager)
+```

package/areas/devops/networking/prompts/service-mesh-onboard.md

@@ -0,0 +1,77 @@
+---
+workflow: service-mesh-onboard
+---
+
+# Prompt: `/service-mesh-onboard`
+
+Use when: onboarding a service to Istio/Linkerd, configuring mTLS, traffic policies, or debugging mesh issues.
+
+---
+
+## Example 1 — Onboard service to Istio with mTLS
+
+**EN:**
+```
+/service-mesh-onboard
+
+Mesh: Istio (installed cluster-wide, sidecar injection enabled per namespace)
+Service: payment-service / Namespace: production
+Task: onboard to Istio mesh with strict mTLS and traffic policies
+Requirements:
+  1. Enable sidecar injection for production namespace
+  2. PeerAuthentication: STRICT mTLS for payment-service (no plaintext)
+  3. AuthorizationPolicy: payment-service only accepts traffic from checkout-service and api-gateway
+  4. DestinationRule: circuit breaker (5 consecutive 5xx → eject upstream for 30s)
+  5. VirtualService: retries (3×, 500ms interval) for 503/504; timeout 5s
+  6. Verify: kiali graph shows mTLS lock icons on all connections
+```
+
+**RU:**
+```
+/service-mesh-onboard
+
+Меш: Istio (установлен на весь кластер, инжекция sidecar включена по namespace)
+Сервис: payment-service / Namespace: production
+Задача: подключение к Istio меш с strict mTLS и traffic policies
+Требования:
+  1. Включить инжекцию sidecar для namespace production
+  2. PeerAuthentication: STRICT mTLS для payment-service (без plaintext)
+  3. AuthorizationPolicy: payment-service принимает трафик только от checkout-service и api-gateway
+  4. DestinationRule: circuit breaker (5 последовательных 5xx → исключить upstream на 30с)
+  5. VirtualService: retries (3×, интервал 500мс) для 503/504; timeout 5с
+  6. Проверить: граф kiali показывает значки mTLS на всех соединениях
+```
+
+---
+
+## Example 2 — Debug: mTLS handshake failures
+
+**EN:**
+```
+/service-mesh-onboard
+
+Mesh: Istio / Symptom: order-service → payment-service returning "connection refused" or TLS handshake errors
+Error in envoy log: "upstream connect error or disconnect/reset before headers. retried and the latest reset reason: connection failure, transport failure reason: TLS error"
+Checklist:
+  1. Check PeerAuthentication mode (STRICT vs PERMISSIVE) on both namespaces
+  2. Check certificate validity: istioctl proxy-config secret <pod>
+  3. Check AuthorizationPolicy on payment-service (may be blocking order-service)
+  4. Verify both pods have sidecar injected (check annotations)
+  5. Test with PERMISSIVE mode temporarily to isolate mTLS vs auth issue
+Output: root cause + YAML fix
+```
+
+**RU:**
+```
+/service-mesh-onboard
+
+Меш: Istio / Симптом: order-service → payment-service возвращает "connection refused" или ошибки TLS handshake
+Ошибка в envoy log: "upstream connect error or disconnect/reset before headers..."
+Чеклист:
+  1. Проверить режим PeerAuthentication (STRICT vs PERMISSIVE) в обоих namespace
+  2. Проверить действительность сертификата: istioctl proxy-config secret <pod>
+  3. Проверить AuthorizationPolicy на payment-service (может блокировать order-service)
+  4. Убедиться что оба пода имеют инжектированный sidecar (проверить аннотации)
+  5. Временно проверить режим PERMISSIVE для разграничения проблем mTLS vs auth
+Результат: корневая причина + YAML исправление
+```

package/areas/devops/networking/rules/ingress-standards.md

@@ -0,0 +1,17 @@
+# Rule: Ingress Standards
+
+**Priority**: P1 — Non-compliant ingress configs are rejected in review.
+
+## NGINX Ingress Standards
+
+1. **One IngressClass per environment** — `nginx` for production, `nginx-staging` for staging.
+2. **TLS required** on all production Ingress — no HTTP-only production routes.
+3. **HTTP → HTTPS redirect** enforced via annotation.
+4. **Rate limiting** on all public-facing Ingress:
+   ```yaml
+   nginx.ingress.kubernetes.io/limit-rps: "100"
+   nginx.ingress.kubernetes.io/limit-connections: "20"
+   ```
+5. **Request size limit**: `nginx.ingress.kubernetes.io/proxy-body-size: "10m"` (override with justification).
+6. **Timeouts defined**: `proxy-connect-timeout: "10"`, `proxy-read-timeout: "60"`.
+7. **CORS** configured explicitly — no wildcard `*` origins in production.

package/areas/devops/networking/rules/network-segmentation.md

@@ -0,0 +1,24 @@
+# Rule: Network Segmentation
+
+**Priority**: P0 — Flat networks are forbidden in production.
+
+## Kubernetes Network Segmentation
+
+1. **Default-deny-all NetworkPolicy** on every production namespace — see kubernetes/rules/workload-security.md.
+2. **Namespace = trust boundary** — inter-namespace communication explicitly allowed only.
+3. **Node network isolation** — control plane nodes in separate subnet; workers in private subnet; no public IPs on nodes.
+
+## Bare-Metal / Cloud Network Zones
+
+| Zone | Contents | Inbound | Outbound |
+|:---|:---|:---|:---|
+| Public | Load balancers, ingress controllers | Internet | Internal only |
+| Application | K8s worker nodes, app servers | From public zone | Internet via NAT |
+| Data | Databases, object storage, message queues | From application zone | None |
+| Management | Jump hosts, CI runners, monitoring | VPN/MFA only | All zones |
+
+4. **Data zone has no outbound internet** — no NAT gateway for DB subnets.
+5. **Jump host or VPN for SSH** — direct SSH from internet to worker nodes is forbidden.
+
+## Service Mesh (when applicable)
+6. **mTLS between all services** when service mesh (Istio/Linkerd) is deployed — no plaintext service-to-service.

package/areas/devops/networking/rules/tls-policy.md

@@ -0,0 +1,32 @@
+# Rule: TLS Policy
+
+**Priority**: P0 — Plaintext in production is a critical violation.
+
+## TLS Requirements
+
+1. **TLS 1.2 minimum** everywhere. TLS 1.0 and 1.1 disabled.
+2. **TLS 1.3 preferred** — configure cipher suites for TLS 1.3 first.
+3. **Certificate rotation** — certificates renewed at 60 days remaining (before 90-day cert expiry).
+4. **cert-manager handles rotation automatically** — no manual certificate management.
+5. **HSTS** — HTTP Strict Transport Security header on all public-facing services (max-age ≥ 1 year).
+6. **Internal mTLS** — service-to-service traffic uses mutual TLS when service mesh is present.
+
+## Ingress TLS (cert-manager)
+
+```yaml
+# TLS with Let's Encrypt (public)
+annotations:
+  cert-manager.io/cluster-issuer: "letsencrypt-prod"
+spec:
+  tls:
+    - hosts: [api.example.com]
+      secretName: api-example-com-tls
+```
+
+## Certificate Sources
+
+| Use case | Source |
+|:---|:---|
+| Public-facing services | Let's Encrypt (cert-manager ACME) |
+| Internal services | Internal CA (cert-manager with Vault PKI) |
+| Wildcard certs | Let's Encrypt DNS-01 challenge |