NeuroLeads API — Kubernetes Produccion

apiVersion: v1
kind: Namespace
metadata:
  name: neuroleads-prod
  labels:
    environment: production
    team: neuroleads
    managed-by: kubectl

apiVersion: v1
kind: ResourceQuota
metadata:
  name: neuroleads-quota
  namespace: neuroleads-prod
spec:
  hard:
    requests.cpu: "8"
    requests.memory: 8Gi
    limits.cpu: "16"
    limits.memory: 16Gi
    pods: "30"

apiVersion: v1
kind: ConfigMap
metadata:
  name: neuroleads-config
  namespace: neuroleads-prod
data:
  LOG_LEVEL: "info"
  APP_ENV: "production"
  MAX_WORKERS: "4"
  PORT: "8000"
  CORS_ORIGINS: "https://app.neuroleads.io"

# CLI: kubectl create secret generic \
#   neuroleads-secrets -n neuroleads-prod \
#   --from-literal=DATABASE_URL='...' \
#   --from-literal=REDIS_URL='...' \
#   --from-literal=OPENAI_API_KEY='...'
apiVersion: v1
kind: Secret
metadata:
  name: neuroleads-secrets
  namespace: neuroleads-prod
type: Opaque
data:
  DATABASE_URL: <base64-encoded>
  REDIS_URL: <base64-encoded>
  OPENAI_API_KEY: <base64-encoded>

apiVersion: v1
kind: Service
metadata:
  name: neuroleads-api
  namespace: neuroleads-prod
  labels:
    app: neuroleads-api
spec:
  selector:
    app: neuroleads-api
  type: ClusterIP   # Interno; Ingress expone al exterior
  ports:
    - port: 80
      targetPort: 8000
      protocol: TCP

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: neuroleads-api
  namespace: neuroleads-prod
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
  ingressClassName: nginx
  tls:
    - hosts: ["api.neuroleads.io"]
      secretName: neuroleads-tls
  rules:
    - host: api.neuroleads.io
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: neuroleads-api
                port:
                  number: 80

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: neuroleads-api-hpa
  namespace: neuroleads-prod
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: neuroleads-api
  minReplicas: 2     # Siempre 2+ para HA
  maxReplicas: 8     # Techo para Black Friday
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70  # Scale si avg CPU > 70%
    - type: Resource
      resource:
        name: memory
        target:
          type: Utilization
          averageUtilization: 80

# PodDisruptionBudget: evita que
# node drains dejen la API sin pods
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: neuroleads-api-pdb
  namespace: neuroleads-prod
spec:
  minAvailable: 2     # Minimo 2 pods disponibles
  selector:           # siempre durante drain/actualizacion
    matchLabels:
      app: neuroleads-api

# Ejecutar ANTES de cada deploy
apiVersion: batch/v1
kind: Job
metadata:
  name: db-migrate-v2-1-0
  namespace: neuroleads-prod
spec:
  backoffLimit: 3
  ttlSecondsAfterFinished: 3600  # Limpiar tras 1h
  template:
    spec:
      restartPolicy: OnFailure
      containers:
        - name: migrate
          image: ghcr.io/neuroleads/api:2.1.0
          command: ["python", "-m", "alembic", "upgrade", "head"]
          envFrom:
            - secretRef:
                name: neuroleads-secrets
          resources:
            requests:
              cpu: "100m"
              memory: "256Mi"

# Limpieza de leads expirados: 2am diario
apiVersion: batch/v1
kind: CronJob
metadata:
  name: cleanup-expired-leads
  namespace: neuroleads-prod
spec:
  schedule: "0 2 * * *"
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 3
  failedJobsHistoryLimit: 1
  jobTemplate:
    spec:
      template:
        spec:
          restartPolicy: OnFailure
          containers:
            - name: cleanup
              image: ghcr.io/neuroleads/api:2.1.0
              command: ["python", "-m", "tasks.cleanup"]
              envFrom:
                - secretRef:
                    name: neuroleads-secrets
              resources:
                requests:
                  cpu: "50m"
                  memory: "128Mi"

# Estado del namespace
kubectl get pods -n neuroleads-prod
kubectl get pods -n neuroleads-prod -o wide

# Ver logs (actual y crasheado)
kubectl logs <pod> -n neuroleads-prod
kubectl logs <pod> -n neuroleads-prod --previous

# Diagnosticar errores
kubectl describe pod <pod> -n neuroleads-prod

# Debug en vivo
kubectl exec -it <pod> -n neuroleads-prod -- bash
kubectl port-forward svc/neuroleads-api 8000:80 -n neuroleads-prod

# Uso de recursos
kubectl top pods -n neuroleads-prod
kubectl top nodes

# Rollback ante incidencia
kubectl rollout history deployment/neuroleads-api -n neuroleads-prod
kubectl rollout undo deployment/neuroleads-api -n neuroleads-prod

# Validar YAML antes de aplicar
kubectl apply -f manifests/ --dry-run=server -n neuroleads-prod

# CrashLoopBackOff: container crashea repetidamente
kubectl logs <pod> --previous -n neuroleads-prod
# Buscar: error de config, missing env var, DB no conecta

# OOMKilled: memoria insuficiente
kubectl describe pod <pod> -n neuroleads-prod \
  | grep -A5 "Last State"
# Aumentar memory limit en Deployment si requerido

# ImagePullBackOff: no puede descargar imagen
kubectl describe pod <pod> -n neuroleads-prod
# Ver sección Events: tag incorrecto, token GHCR caducado
# Crear imagePullSecret si aplica:
kubectl create secret docker-registry ghcr-secret \
  --docker-server=ghcr.io \
  --docker-username=<user> \
  --docker-password=<token> \
  -n neuroleads-prod

# Pod Pending: recursos insuficientes en el cluster
kubectl describe pod <pod> -n neuroleads-prod
# Buscar: Insufficient cpu/memory, taint/toleration mismatch
kubectl get events -n neuroleads-prod \
  --sort-by='.lastTimestamp'